4 ms·

What do you think about sandboxing,is it possible to think of each process as a separate virtual machine in order for them to be "rootkitproof"?

thirsteh 14y ago
If what you're trying to prevent is something in sandbox A messing with something in sandbox B, sure. If you want to prevent is malicious behavior generally, like connecting to a botnet or exploiting a vulnerability in a system service, not so much. Then you need a mixture of sandboxing and whitelisting (rather than blacklisting), a combination that's unwelcome in most environments (a notable exception being app stores.)
- gizmo686 14y ago
  Part of the 'standard' model for security is to make every component as sandboxed as possible. The problem is, programs need to be able to access the system, and if the attack compromises the program it can do whatever the program can. For example, most web browsers have the ability to show html pages that are stored anywhere on your file-system. This means that if your web-browser gets infected, the attacker has full read access to you files. You can (and I do) sandbox your browser to only its files, however you then loose the features that depend on full read access. Of course, the instance of the javascript VM that is running the javascript from the website does not need filesystem access, so it can be, and normally is, sandboxed.
  - ernesth 14y ago
    > The problem is, programs need to be able to access the system Not necessarily: to be on the Mac App Store, an application must access only files in its own resources (configuration and so on) or through user interaction (open file dialog). If your web browser gets infected, it gets full read access on every file you willfully want it to read. Problem, you cannot have a multimedia player that opens m3u playlist files in this model: see http://mplayerx.org/leave-mas.html http://mplayerx.org/leave-mas.html
  - deleted 14y ago
    [deleted]
fpp 14y ago
this has been done by a company called Advanced Computer Research in the 1990s - it has been proven to be working very well, so well that it was taken off the market (with force / criminal means). Officially the company was sold to an US conglomerate and immediately all products were taken off the market. It was - in difference to the snake oil antivirus software sold commercially otherwise since then - also able to protect against unknown threats by creating a security focused virtual machine inside the PC and a sandbox around applications. This was the first VM available for PCs (1995) The only links still visible that I could quickly find are: http://www.securityfocus.com/tools/803 http://www.securityfocus.com/tools/803 http://web.archive.org/web/19990117023714/http://www.acrmain.com/index.html http://web.archive.org/web/19990117023714/http://www.acrmain...
- thirsteh 14y ago
  What you're describing is whitelisting vs. blacklisting. Whitelisting will always be the better solution, but it presents far more usability and "approval process" problems than blacklisting does.
- oconnor0 14y ago
  That sounds very conspiratorial. What evidence do you have that it was taken off the market via force / criminal means?
  - fpp 14y ago
    first hand experience
- deleted 14y ago
  [deleted]
mikemoka 14y ago
what about http://www.sandboxie.com/ http://www.sandboxie.com/ ?
zby 14y ago
This is the approach of Qubes-os: http://qubes-os.org/Home.html http://qubes-os.org/Home.html By they way read also their blog: http://theinvisiblethings.blogspot.com/ http://theinvisiblethings.blogspot.com/
- based2 14y ago
  http://en.wikipedia.org/wiki/Multics http://en.wikipedia.org/wiki/Multics

thirsteh 14y ago

If what you're trying to prevent is something in sandbox A messing with something in sandbox B, sure. If you want to prevent is malicious behavior generally, like connecting to a botnet or exploiting a vulnerability in a system service, not so much. Then you need a mixture of sandboxing and whitelisting (rather than blacklisting), a combination that's unwelcome in most environments (a notable exception being app stores.)

gizmo686 14y ago
Part of the 'standard' model for security is to make every component as sandboxed as possible. The problem is, programs need to be able to access the system, and if the attack compromises the program it can do whatever the program can. For example, most web browsers have the ability to show html pages that are stored anywhere on your file-system. This means that if your web-browser gets infected, the attacker has full read access to you files. You can (and I do) sandbox your browser to only its files, however you then loose the features that depend on full read access. Of course, the instance of the javascript VM that is running the javascript from the website does not need filesystem access, so it can be, and normally is, sandboxed.
- ernesth 14y ago
  > The problem is, programs need to be able to access the system Not necessarily: to be on the Mac App Store, an application must access only files in its own resources (configuration and so on) or through user interaction (open file dialog). If your web browser gets infected, it gets full read access on every file you willfully want it to read. Problem, you cannot have a multimedia player that opens m3u playlist files in this model: see http://mplayerx.org/leave-mas.html http://mplayerx.org/leave-mas.html
- deleted 14y ago
  [deleted]

fpp 14y ago

this has been done by a company called Advanced Computer Research in the 1990s - it has been proven to be working very well, so well that it was taken off the market (with force / criminal means). Officially the company was sold to an US conglomerate and immediately all products were taken off the market. It was - in difference to the snake oil antivirus software sold commercially otherwise since then - also able to protect against unknown threats by creating a security focused virtual machine inside the PC and a sandbox around applications. This was the first VM available for PCs (1995) The only links still visible that I could quickly find are: http://www.securityfocus.com/tools/803 http://www.securityfocus.com/tools/803 http://web.archive.org/web/19990117023714/http://www.acrmain.com/index.html http://web.archive.org/web/19990117023714/http://www.acrmain...

thirsteh 14y ago
What you're describing is whitelisting vs. blacklisting. Whitelisting will always be the better solution, but it presents far more usability and "approval process" problems than blacklisting does.
oconnor0 14y ago
That sounds very conspiratorial. What evidence do you have that it was taken off the market via force / criminal means?
- fpp 14y ago
  first hand experience
deleted 14y ago
[deleted]

mikemoka 14y ago

what about http://www.sandboxie.com/ http://www.sandboxie.com/ ?

zby 14y ago

This is the approach of Qubes-os: http://qubes-os.org/Home.html http://qubes-os.org/Home.html By they way read also their blog: http://theinvisiblethings.blogspot.com/ http://theinvisiblethings.blogspot.com/

based2 14y ago
http://en.wikipedia.org/wiki/Multics http://en.wikipedia.org/wiki/Multics