Protect your computer with a sandbox

I was thinking about the password harvesting trojan that was spread on this forum a few weeks ago, and how it could quite easily be avoided with a sandbox. Here is one I've used before. I recommend it be used in preference to never downloading anything from the forums ever again:

http://www.sandboxie.com

Essentially it limits where a program can write to on the harddisk?


How would that prevent a password harvester though? Does sandboxing limit reading too?

A real sandbox has no access to anything on your machine or network.

When using a sandbox, most people use a Virtual Machine within their machine. That virtual machine can only access memory space granted to it, can only access a virtual hard disk, and cannot access the network unless allowed. It basically appears as whole computer to the programs running within it.

After using the program on the sandbox, the sandbox is then reset to what it was before the program was run, so it does not become infected either.

I personally use VMWare to accomplish this task.

Yeah, if you really want/need a secure sandbox, you should use WMWare, VirtualBox or one of the alternatives. I have a VirualBox install of XP, where I install some programs I only need once. (Eg. codecs for obscure video formats.) I can restore it to initial state whenever I want.

However, virtual machines are usually very limited when it comes to OpenGL or DirectX stuff, so you might not be able to run many demos.

I think virtual operating systems (running bytecodes or similar in a virtual machine) is going to be the future. When everything is confined to a virtual space and you're controlling exactly what gets to execute you can prevent pretty much all major problems.

However, anyone can take anything to be malicious. Any program performing any action could be interpreted as malicious if it offends a particular person based on that person's preferences. When windows applications interrupt what I'm working on `against my will` I could consider that malicious. Effectively, ALL code is potentially malicious when you look at it as such. So is the code malicious? No, it's how you perceive it and what its behavior means to you. Someone researching viruses or finding great enjoyment learning how to hack computers might be thrilled at seeing malicious software behave, whereas others might find it offensive. It's all in the eye of the beholder. You can't censor ALL software, which is what you'd have to do to stop all malicious activity. The only other choice is that you change your way of looking at it. Trying to get the computer to change is really an excuse for people not to change. It's basically like saying `I want to keep on seeing xyz as malicious so you must remove xyz from my experience so that I can pretend I am happy - until xyz comes along and upsets me`.

Sandboxie is relatively simple in both the way it works and the user experience. It merely virtualises the programs file system (reading and writing). As stated above this gives you the advantage of being able to run apps at full speed and with all hardware acceleration available.

Yeah, sandboxes. Great accessory for computers.

I thought I'd give it a go myself. I put my PC in here. I don't think any viruses will ever find it in there.

the biggest problem with a sandboxed environment like VMWare is that it also tends to emulate a pretty crappy 3D adapter, so your video capabilities are a LOT less than running it natively. you can forget to run any half-way taxing 3D thing, for example.