vunerability

street011 · Post by **street011** » Thu Jan 18, 2007 5:44 am

hi there,

i was just reading this article:
http://handlers.sans.org/tliston/Thwart ... koudis.pdf

and i wondered how vunerable sandboxie is to these attacks and detection methods.

maybe we can learn from it and make sandboxie even stronger.

Unknown_User_596 · Post by **Unknown_User_596** » Thu Jan 18, 2007 7:17 am

I think these detection techniques are not a problem for sandboxie because they are focused on Virtual Machines.

Detecting sandboxie is much more easier! => But if the number of users of sandboxie is small nobody will make a extra detection for that.

In the end sandboxie works similar like a rootkit. => That way it is already detected by tools like rootkit unhooker as a possible rootkit. (Random change of the process names (sandboxiedcom,...) would add already a lot of protection)

street011 · Post by **street011** » Thu Jan 18, 2007 10:42 am

detection is not the biggest problem, breaking out is imho.

i've recently discovered sandboxie (about 5 days now)
and i recommended it to over 10 people, all using it now.

so i'm expecting popularity will grow FAST.
i'm wondering how long sandboxie is going to keep us safe (isolated)

Unknown_User_596 · Post by **Unknown_User_596** » Thu Jan 18, 2007 11:27 am

To break out of sandboxie in a planned way, detection is the first step.

I'm not going to use sandboxie for the hard stuff => vmware is definitiv much more secure. Sandboxie is one additional security layer that is available on my pc. Before sandboxie i did use limited user accounts for more security. Sandboxie is just much more comfortable and works also for applications that want to have administrative rights but of course it has some security leaks. I personally think it is not very difficult to get around sandboxie if you know that it is sandboxie where you want to get around.

tzuk · Post by **tzuk** » Thu Jan 18, 2007 8:04 pm

This thread seems to imply that the strength of Sandboxie is in its relative obscurity, and if only the malware could detect Sandboxie, then that malware could circumvent Sandboxie.

I strongly disagree.

By comparison, suppose a program has detected that it is running under a limited user account, rather than an administrator account. But does this insight allow the program to elevate itself to administrator privileges? Of course not.

Unknown_User_596 · Post by **Unknown_User_596** » Fri Jan 19, 2007 3:25 am

@tzuk: You are right. It will not be easy to get around sandboxie. For average virus programmers it will be impossible.

A lot of File Services like NTClose, NTCreateFile,NTDeleteFile, NTQueryxxx and the Driver Services like NTLoadDriver or also Interprocesscommunication and some other services are hooked by sandboxie. But to be honest, there are a lot of other ways to get to the system level! Without going into details to much cause I don't want to make some sample code just to show it is possible i think sandboxie has of course as any software some limitations. I think that is fine because the security that you get by the use of sandboxie is very good.

However everybody has to keep in mind that every security solution has limitations:
No Virus Scanner is really protecting you from a virus. No trojan scanner will protect you from beeing infected by a trojan. No personal firewall will really protect you from unwanted traffic. ... the same is true for sandboxie

street011 · Post by **street011** » Fri Jan 19, 2007 3:50 am

@tzuk

my post was in no way to imply sandboxie doesn't do what it's supposed to do, as far as my experience with it goes it's very secure. (as you can read in other posts of mine)

i just posted it as a note, maybe we can find weaknesses and make it even stronger.

I've had some emailing done with Roger from infoworld.
He told me it was peanuts to break out of any sandbox or VM environment.
I asked for specific methods or weaknesses on how he thought sandboxie could be 'hacked'. Funny enough he couldn't tell... he didn't try it with sandboxie, but was strongly convinced it was piece-o-cake too.

so that made me wonder and so i put up this topic

just for the benefit of security, i like - LOVE sandboxie!

tzuk · Post by **tzuk** » Fri Jan 19, 2007 4:53 pm

Thank you for the praise, I didn't mean to say I was taking offence to what you say or anything like this. Not at all. I'm just surprised at some people jumping to conclusions. For instance:

... there are a lot of other ways to get to the system level! Without going into details to much ...

Oh, I wish you would go into that detail. Otherwise you're just saying "there are other attack vectors ... I think! ... But anyway I'm not telling" which is just . . . puzzling.

street011 · Post by **street011** » Fri Jan 19, 2007 6:14 pm

@ Tzuk

i think i found at least one weakness...
when i send a HWND WM_CLOSE broadcast from a program running in sandboxie, practicaly my whole system shuts down...
can't be good i think?

also i was able to inject code into processes outside the sandbox (ofcourse again from an application running inside)

tzuk · Post by **tzuk** » Sat Jan 20, 2007 6:11 pm

can't be good i think?

Did you use BroadcastSystemMessage?

also i was able to inject code into processes outside the sandbox

Really? How? Windows Hooks maybe?

street011 · Post by **street011** » Sat Jan 20, 2007 9:08 pm

i used a classic old little program called "spy & capture".

i used HWND_BROADCAST / HWND 0 / WM_CLOSE,

same for the other actions, WM_GETCAPTION WM_SETTEXT WM_PASTE etc, they all work

OwenBurnett · Post by **OwenBurnett** » Sun Jan 21, 2007 5:29 am

Do you meen http://programmerstools.org/node/348 ?

To inject code have you also used this app?

street011 wrote: He told me it was peanuts to break out of any sandbox or VM environment.

Escaping an SB can be indeed possible when a week point is found sure,
but I have string doubts that it is possible to escape from an Virtual Machine (like VMWare).
I would realy like to know how this can be achieved.

Owen

street011 · Post by **street011** » Sun Jan 21, 2007 7:52 am

yes thats the nifty tool i used, used it in the early days to hide running applications at school (unreal tournament

)

i'm very currious too on how you can break out of VM or sandbox

OwenBurnett · Post by **OwenBurnett** » Sun Jan 21, 2007 9:38 am

I have somehow problems to get it to work,
could you please describe step by step what to do to reproduce the CLOSE thing an the code injection

Owen

tzuk · Post by **tzuk** » Sun Jan 21, 2007 11:53 am

Yes, please elaborate a bit more. If there's a hole, I'd like to close it.

Sandboxie Support

vunerability

vunerability

Perfect security?

Who is online