 Number 309 - February 2009 |
|
| Sandbox Computing | |
|
by Brian K. Lewis, Ph.D. Sarasota Personal Computer Users Group, Inc. | |
|
I spend a lot of my time surfing the web looking for research material; computer tech sources, genealogy data, vocal music and other information. This means that I am downloading many web pages, clicking on many links and generally opening up my computer to all types of malware. I always have to be aware that there are many traps on web pages that are just waiting for the unwary surfer. It used to be that having an up-to-date virus checker, a working firewall and parasite scanners, you could adequately protect your computer. That changed to some degree when the "drive by" downloads appeared. Now with the constant appearance of "holes" in the Windows operating system (XP & Vista) and the various web browsers, it is less obvious that you can protect your computer from unwanted visitors. Microsoft recently (October 22, 2008) released an out-of-cycle patch (patch 958644) for Windows for what has been described as a very serious opening that could be exploited regardless of the browser you are using. There have also been recent articles on "clickjacking". In this situation "buttons" or links are floated behind the link you think you are clicking. The only option to prevent this is to disable JavaScript. That creates more problems as JavaScript is a very important part of the whole web experience and is used on almost every page. So when you do know that you can run a script and when you can't? Well, the "Sandbox" may be a way to surf safely and avoid the installation of malware on your computer without having to disable JavaScript. My Sandbox experience is based on using the sofware application "Sandboxie" ( Next, let's take a look at what is meant when I talk about a computer sandbox. The sandbox is a complete "virtual computer" running in your computer's memory. This virtual computer is isolated from the real operating system files and creates any files it needs for use within the sandbox. When the sandbox closes, everything in it disappears unless you chose to keep it. It's like having a bank vault within a building where everything can be locked within the vault and nothing is removed without special permission. The neat thing is that nothing that happens within the sandbox can have any effect on your computer. This means that Trojans, rootkits and other malware have no chance to affect the operation of your computer outside of the sandbox. If a problem occurs when you are running in the sandbox, all you need to do is shut it down, you are returned to your normal computer operations and the malware is erased. When Sandboxie is started it creates a sandboxed folder which contains a drive folder, user folder, and Registry "hives". The "hive" is Microsoft's term for collections of related Registry keys stored together. The parts of the Registry needed for sandboxed operations are stored in a hive which is then integrated into the Registry. There are also instances of Windows services stored within the sandboxed folder that can be accessed by applications running within the sandbox. These are referred to as "process objects" and are needed for normal operations. When the sandbox is running there may be instances of these objects running both sandboxed and non-sandboxed. Also, you can run an application within the sandbox at the same you are running it outside the sandbox. The complete operating system is not loaded into the sandbox. This reduces the memory required for the sandbox operations. Applications running in the sandbox can not hijack non-sandboxed programs. Therefore they can not operate outside the sandbox. New files or other created objects have a path assigned by Sandboxie which directs them into the sandboxed folders. Sandboxie prevents any programs running inside the sandbox from loading drivers directly. It also prevents programs from asking a central system component, known as the Service Control Manager, to load drivers on their behalf. In this way, drivers, and more importantly, rootkits, cannot be installed by a sandboxed program. This is one of the features that prevents rootkits from being installed outside the sandbox. |
In actual operation, using Sandboxie is very simple. To make it even simpler, there is a short tutorial available on the Sandboxie web site. This can be accessed from within the program the first time you run it or directly from the Sandboxie home page by clicking on the "FAQ & Help" link. After installation it can be set to load whenever the computer is started. This puts an icon in the system tray. Clicking on this icon brings up the Sandboxie Control Center. This window lists all sandboxed applications and object. When I started it, the window indicated nothing was sandboxed. So, using the menu I selected run an application and then selected Firefox. This changed the list in the window to show Firefox as well as the two RegHive files. With Firefox up, I did my usual web surfing. Along the way I received a message from Sandboxie that a new version was available that I could download. At this point, I really couldn't tell that anything was different from my previous surfing experience with Firefox. So I went to the Sandboxie page and downloaded the new version. After finishing I closed the Sandboxie Control Center. Then I went looking for the download so I could install it. Well, it didn't exist anywhere on the hard drive! I had closed Sandboxie without marking the update to be saved! As a result the download was deleted, along with all the other sandboxed files when I closed the Control Center. So I opened the Control Center, restarted Firefox and downloaded the update. This time I selected it to be saved before I closed the Control Center. Then I was able to install the update. I should also point out that now I have an icon on the desktop which automatically runs Firefox sandboxed. Sandboxie can be set up to isolate your browser automatically whenever you open it. To do so, add the name of your browser's executable file, such as firefox.exe or iexplore.exe, to the list of programs Sandboxie always opens in a sandbox. If you don't do this, Sandboxie will not set your browser to open automatically in the sandbox. As you can tell from these comments, Sandboxie does not require a reboot to start the sandbox process. Sandboxie does sandbox access to files, but not to the complete hard drive. It does sandbox access to registry keys. It also sandboxes access to many other classes of system components, in order to trick the sandboxed program into believing that it isn't being tricked. So you can open and close Sandboxie repeatedly while you are using your computer without having to do any rebooting. If this discussion has interested you and you would like to take Sandboxie for a test run, the free version can be downloaded from: www.sandboxie.com. This application is free for personal use. However, there is a Pro version available for $30.00. If you like the program and can afford it, buy the Pro version. This software is the work of one person, Ronen Tzur, and this payment is his means of support to continue working and improving this software. After some experience in running Sandboxie, I can highly recommend it as an excellent method of protecting your computer from malware. Dr. Lewis is a former university and medical school professor of physiology. He has been working with personal computers for over thirty years, developing software and assembling systems. He can be reached at bwsail at yahoo.com. Copyright 2009. This article is from the January 2009 issue of the Sarasota PC Monitor, the official monthly publication of the Sarasota Personal Computer Users Group, Inc., P.O. Box 15889, Sarasota, FL 34277-1889. Permission to reprint is granted only to other non-profit computer user groups, provided proper credit is given to the author and our publication. |
|
Number 309 - February 2009
|
|