- The malicious document is opened when the Confidential private document was not closed or was saved into Documents folder (and redirected to ReHips User profile). That can happen to the inexperienced user.
- Malware in the sandbox will exploit the application (for example not supported by Microsoft - Office 2007), and then it will have the read access to all user's documents.
- Malware in the sandbox will scan the disk, read registry keys, .ini files, installed software, etc. to gather the information about the system.
1. I agree, it's possible to mess something up. In the end, it's up to the user to follow the best practices. User being the final and ultimate judge can just disable the security and no product can protect from it. What I mean is ReHIPS is trying to provide a way for security, but it's up to the user to follow that way and yeah, sometimes it requires knowledge and not that easy as we'd like it to be, but that's why we're here and we're working on it
2. Exploiting the isolated program will grant basically the same rights and privileges as something executed in the same isolated environment. So it'll have no access to real user profile. And will have access to at most 1 document in C:\ReHIPS subfolder.
3. I agree, it can gather some information, but will it be a security incident? All sensitive data should be stored in real user profile, malware will have no access to it. It can read public and already well-known files from Windows directory, from Program Files directory, it'll probably learn that I have for example Opera installed. Maybe it's not comfortable to know that this information left PC, but it doesn't look critical.
And I see there is a discussion of Open File Access feature. It's described in this blogpost
[FAQ] Convenient yet treacherous Open File Access feature
In short words: it's not recommended to rely on it, it's more of a "workaround" for usability. But if you indend to build a secure and reliable system, it's preferred to disable it.
But what you see as a real user will be slightly different for isolated programs. For example I say that isolated programs don't have any access to real user profile. When you browse there in explorer and double-click on some document, Open File Access feature kicks in and does some magic for the isolated program to successfully access the document. But isolated programs can't do it on their own, this magic won't work for them. When they try to browse real user profile folder (or registry hive) they're transparently redirected into their own isolated (ReHIPSUserX) profile folder (or registry hive) and can see and access only files from there.
Best regards, fixer.
