Medical Imaging Disc Error

[sgrechtman]

We bought 40 corporate copies of Sandboxie to allow medical staff to view medical imaging discs (cd's/dvd's) while being sandboxed. On one of these types of discs, while launching the viewer, an error is received. It seems like it's a .NET error or another library, but I'm not entirely sure. It seems like the application (Reviewer.exe) is unable to access something that it needs outside of the sandbox. The disc does work while being launched normally (not sandboxed). I have gone through email support for this issue as well, but it hasn't been resolved yet. I have tried some suggestions adding the entire dvd drive and/or folders as direct access exceptions (have tried many combinations), but it still throws an error (although I have seen it throw a different error message). Any assistance with this will be greatly appreciated.

OS: Win7 Enterprise SP1 x64
.NET: 4.5.2
Sandboxie: 5.08

Thanks!



Error screenshots are attached. 001 is the normal error. 002 is received after adding exceptions.




UPDATE:

Here are the actual error messages copied/pasted:

---------------------------

---------------------------
Access denied - at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
at System.Management.ManagementEventWatcher.Start()
at Reviewer.Common.IO.WMIVolumeWatcher.CreateWatcher(String eventClassName, String eventQueryString, EventArrivedEventHandler handler)
at Reviewer.Common.IO.WMIVolumeWatcher.LoadOpticalDriveEvents()
at Reviewer.Common.IO.WMIVolumeWatcher..ctor()
at Reviewer.Common.ReviewerGlobal.Start()
at Reviewer.Program.ApplicationInstance.OnStartup(StartupEventArgs eventArgs)
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(String[] commandLine)
at Reviewer.Program.Main(String[] args)
---------------------------
OK
---------------------------




---------------------------

---------------------------
Cannot create a file when that file already exists.
- at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.__Error.WinIOError()
at System.IO.File.Move(String sourceFileName, String destFileName)
at Reviewer.Program.InitializeTracing()
at Reviewer.Program.ApplicationInstance.OnInitialize(ReadOnlyCollection`1 commandLineArgs)
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(String[] commandLine)
at Reviewer.Program.Main(String[] args)
---------------------------
OK
---------------------------

[sgrechtman]

Bump. Still trying to get a solution/workaround for this if possible.

[Craig@Invincea]

I spoke with Curt this afternoon, and from the Procmon, there isn't anything there we can see. Something is being blocked, but what we don't know.

Is there a way (a trial) of this software we can look at to test internally?

[BUCKAROO]

Sandboxie Control . Configure . Forget Hidden Messages

System.Management.ManagementEventWatcher.Start()
"Subscribes to events with the given query and delivers them, asynchronously, through the EventArrived event."

Code: Select all

SBIE2205 Service not implemented:  WMI IWbemServices 23

ExecNotificationQueryAsync
Asynchronous version of the IWbemServices::ExecNotificationQuery method.
Opnum: 23

If you use a prescribed workaround -- search the error message, the method isn't supported by Sandboxie -- to talk to the real Windows Management Instrumentation (WMI), uh it probably won't workaround it but quit at new ManagementEventWatcher(); if not sooner.

So I don't know what you're gonna do save for an examination of the assembly and a hacking an ear off of the binary.

[Craig@Invincea]

I'm wondering if there is a "need" to SB this drive?

If it's reading imaging software, which I'm going to assume is in house created? I would think not SB'ingthis instance would be best? I can understand if the drive is to be on a machine that could be shared, and unknown programs that could be run from a CD/DVD...but this seems like known data from a known source?

This has been a topic of conversation.

[BUCKAROO]

Med discs / archived images and respective re-viewer programs could arrive from referred specialists / doctors / patients themselves / social engineers with the perfect bait to unleash a Trojan, for the software has internal network access...

Best search out alternative DICOM software and/or script-your-own launcher entwined with a borrowed / working and up-to-date DICOM program from one of the successful img discs or reputable software vendor, one-suits-all app that will Sandbox.

[TriStarGod]

From the .NET error, it looks like an permission issue. I don't have a CD/DVD drive but check if you can give Sandboxie readonly access to the entire CD/DVD drive (including an empty one) and then running the Disc.

[BUCKAROO]

A feature of the language was explicitly denied by Sandboxie because a service for it has not been implemented. But he tried that drive "exception", leads to a second error ahead of the first error (still to follow this one) which isn't a file access issue but we brought about this one (additional) such problem.

Here's an example [Sandbox] configured in such a way that it will substitute any AutoRun program with any alternative task you give it to perform.

[DICOM]

Enabled=y
ConfigLevel=7
Template=BlockPorts
Template=LingerPrograms
Template=AutoRecoverIgnore
BorderColor=#00FFFF,ttl
BoxNameTitle=y

NotifyInternetAccessDenied=y
ClosedFilePath=InternetAccessDevices

Comment=Force sandbox autorun programs and files from removable media drives:
#ForceFolder=B:\
ForceFolder=D:\
ForceFolder=E:\

Comment=Suppose we have chosen XnView as our preferred viewer
LeaderProcess=xnview.exe
LeaderProcess=XnView-win-full.exe
LeaderProcess=XnView-win.exe
LeaderProcess=XnView-win-small.exe

Comment=Always AutoExec LeaderProcess if it is not running & Cancel autorun/force/initiating process unless manually sandboxed & Auto launch our own leader process instead of autorun. [Note: Unfortunately our ini variables aren't expanded by AutoExec]

AutoExec="%ComSpec%" /C"REG DELETE "HKCU\SOFTWARE\SandboxAutoExec" /va /f&TASKKILL /FI "IMAGENAME ne Sbie*" /FI "IMAGENAME ne Start.exe" /FI "IMAGENAME ne Sandboxie*" /FI "STATUS eq UNKNOWN" /F&START "" "%ProgramFiles(x86)%\XnView\xnview.exe" -full "E:\DICOM\*""

Comment=XnView defaults are Space for Next file, Backspace for Previous file, F11 to return to XnView Browser providing that images in the path, specified on its command line, exist. Mess with XnView's options and add/remove its arguments above until satisfied.

[TriStarGod]

Aah, sorry. I overlooked that sentence. From my experience, med disks are usually self contained discs with a viewer and the DICOM images. In our office, I have a separate non-networked computer floating around specifically for viewing these images. Due to the variations among med disks, it may be difficult to get Providers to reliably access the images without the technical know-how. Was the issue resolved?

[Craig@Invincea]

Aah, sorry. I overlooked that sentence. From my experience, med disks are usually self contained discs with a viewer and the DICOM images. In our office, I have a separate non-networked computer floating around specifically for viewing these images. Due to the variations among med disks, it may be difficult to get Providers to reliably access the images without the technical know-how. Was the issue resolved?

It hasn't been resolved. We've looked at PML's, etc now for a few months. The Devs are suggesting just to unsanbox the drive, let it do what it needs to do..and the sandbox the drive again. It's not a use case anyone here has seen before unfortunately .

[sgrechtman]

Thanks for the info you guys!

Some backstory for you......
These are shared devices that have access to our internal network and some external internet access as well. This is how the clients wanted these devices setup (they wanted them to be used for other things besides a dedicated viewing station), and they wanted to be able to view these image discs with as much security as possible. We suggested that they have separate offline viewing devices, but they didn't want this.....We will probably end up telling them to open the discs normally if they have issues being sandboxed. They use many different DICOM vendor discs.

[Curt@invincea]

Have you tried running the resource access monitor?

[sgrechtman]

Have you tried running the resource access monitor?

Yes I did run this, and received a log file, but I was unable to determine anything from it.

Here is the link for the log file: https://app.box.com/s/sa79mraynp5287xhxfkqtzggkrqz92c1