Something like a firewall...

[Xerye]

Hey.
What do you think:

Sandboxie is great.
But...
When you got, for example an icq trojan, sandboxie is kinda useless.
It prevents the damage that the trojan would have done to important system datas.
But he read the icq account file and sent it to someone that steals your account now.

So I thought if there is a possibility, that sandboxie will become a little firewall.
Really nothing big, just a "is this application allowed to have internet access?" question that pops up, when a program wants to connect to the internet.
I thought that this will be the last security hole, then sandboxie will be a absolutely protecting program.
What I thought about this feature:
---
-) You can activate this feature in sandboxie control, because some people wont linke to be asked if this and that application is allowed to have internet access, because maybe they think it nervs.

-) If you allow or denie any application to have internet access or not, you can choose that this desicion will be remembered.
So you never get asked about this program again, even you deleted the sanbox.
---

Regrets


And sorry for my very bad english, I hope you all can understand what I mean

[Shield]

You can grant restrictions to certain files/folders in the sandbox.

More specifically, you have an option to allow/deny applications connecting to the internet.

So for example, you could set ICQ.exe to connect to the internet, anything else in that sandbox will be denied internet access.

EDIT: Forgot to mention this - You can enable a setting that alerts you when unauthorized apps try to connect to the internet.

Issue message SBIE1307 when access is denied: When a program is restricted due to this setting, Sandboxie can issue a notification message. Use this checkbox setting to indicate whether you would like to receive these notifications.

Read:
http://www.sandboxie.com/index.php?Rest ... s#internet

[Xerye]

I know this.
But if you install something that includes trojan without you know it, the trojan can connect to the internet.
Thats the danger, that asking if the application is allowed to access the internet would prevent

[SnDPhoenix]

No Xerye, with the Internet restrictions feature in Sandboxie, if you set an executable to be allowed access to the net, only THAT program can connect... nothing else could... including the trojans executable

Now you are referring to the aspect of if something included a trojan. Ok, well then use this example.
You decide to install a program, simply named "Setup.exe", you allow setup to access the internet and nothing else.
When you install the program, lets say in the installer extracts something called "Exporer.exe" and is a trojan...
Well how is that trojan going to connect to the net when only setup.exe was allowed?

[Shield]

I think what Xerye might've been trying to say was, what if this threat Exporer.exe somehow injects itself into Setup.exe thus giving itself internet access.

I guess you could, restrict apps from running in the sandbox but of coarse you'll have to compromise Functionality for Security.

Refer to these articles:
http://www.sandboxie.com/index.php?RestrictionsSettings
http://www.sandboxie.com/index.php?Reso ... s#overview

Then there's the possibilty that there may not be an Exporer.exe because the threat may have already been embedded into Setup.exe in the first place

You can only do so much...

[SnDPhoenix]

Yeah I see what you're saying shield which is why I figured he made this thread in the first place.
However the reason I brought up the seperate process (in this case, the example "exporer.exe") is because even if a malicious file did exist inside another file (like the example, setup.exe), the trojan would still be running as its own seperate process, so the internet access (and restricted access you brought up) settings would apply to the trojan...

Also about injection, I think tzuk mentioned one time that exe injection is not possible inside a sandbox, but I am not sure as I can't really remember...

[Xerye]

What I'm scared about is this:
http://www.sandboxie.com/img/NewGui/Int ... ttings.png
After the installation of sandboxie "All programs can access the internet".
Now you have to think about it, that many people don't know the option Sandboxie Control > Sandbox Settings > Restrictions > Internet Access.
So the people using a sandboxie, where every program can access the internet.
Now image, they install something dangerous.
Then its like here:
http://img162.imageshack.us/img162/9481 ... xieet8.png
A short internetactivation, and your e-mails and other private things where sent to a phisher...
Thats why something like a firewall will be usefule I think.

[tzuk]

Why don't you just get a firewall? It could tell you a trojan.exe is trying to connect to such and such computer. And you would say to deny.

[Xerye]

But when sandboxie gets this firewall feature, it will be like a total security software.
That applications are able to access the internet without you notice, that is the biggest securityhole in my opinion.

Im sure everyone has a firewall.
But imagine sandboxie will do the same - without beeing 20MB big or even bigger.
Just a simple "Is this Application allowed to access the internet?" question.
You can decie "yes" or "no", and if this answer will be remembered.
And I thought of an option where you can deactivate this firewall feature, if someone will use normal firewalls.
But I think it would be very useful - a simple question "yes" or "no" would be much better then the hundreds of things you can configure in normal firewalls.

[wraithdu]

Sorry dude, I can pretty much guarantee from many past discussions, this will never happen. Sandboxie was never intended to be a firewall or your idea of a "total" security solution.

[tzuk]

Well Xerye, a firewall is not a small addition that I can do in 30 minutes. It's an entire area of Windows development and it's not related to the principle of Sandboxie. Which is why I suggested you find a dedicated firewall product that you like. Surely not all of them are bloated 20MB software?

[Shield]

Maybe this is unnecessary but would it be too much work to add an option to restrict port access to applications?

[tzuk]

Well, yes, that's essentially what I just said, because filtering port access means creating a firewall product.