Advice Request Do I still need a Sandboxing Utility ?

[AMD1]

Hi,

I am just wondering if I would need to re-install a Sandboxing Program with my current set-up of :

KTS 2018
Kaspersky Secure Connection
NVT EXE Radar Pro(beta)
Browser Microsoft Edge (default) plus IE

When I use KTS Safe Money, there are certificate verification notifications for websites like Ebay and Amazon which I frequently use.

NB I tried SHADE Sandbox earlier today but it seemed buggy on my machine and whilst I have a paid license for SandBoxie, it had known conflicts in the past with Kaspersky up to version 2017 but this still seemed to be the case when I tried it again today using IE (Initialization failed for process iexplore.exe).

Havinf read some posts reference Sandboxing today, I believe that MS Edge has its own container and therefore supporting Sandboxing Software would not be necessary ?

I am only seeking to have a "safe container" when I am browsing websites.

Any thoughts appreciated.

Andy

 

[Deleted member 65228]

You don't need an external sandbox component, it's not mandatory. Some people like to use one.

You have Kaspersky Total Security which comes with a safe browser you can use when browsing online; Microsoft Edge is also quite secure by default and they use AppContainer - AppContainer isn't like using an external sandbox but it is still beneficial. The Kaspersky safe browser does more than prevent key-stroke interception, it also prevents screen capture catching the browser (it'll display as black AFAIK) - they also use virtualisation for it.

Kaspersky Total Security also has Application Control... I'm sure @harlan4096 can provide more insight into this among other good features of KTS.

You also have an anti-executable.

Regarding Internet Explorer, don't use that anymore. It's old and obsolete now.

Do research on new downloads, don't download from untrusted sources and don't be click-happy.

If your current configuration is not sufficient enough to protect you then nothing will. Your own actions are just as important. More security software does not equal additional security all the time. There's no golden ticket to being invincible.

 

[Ink]

Some people like to use one.

Today I was considering whether or not to install SBIE, but then I realized I don't need it.

@AMD1
For Windows 10 user:
Internet Explorer can be Uninstalled (disabled) via Settings > Apps > Under (Apps & Features) > Manage optional features.

 

[AMD1]

@AMD1
For Windows 10 user:
Internet Explorer can be Uninstalled (disabled) via Settings > Apps > Under (Apps & Features) > Manage optional features.

@Spawn - what does this actually achieve by disabling it ?

 

[Deleted member 65228]

@Spawn - what does this actually achieve by disabling it ?

If malware wants to use it, it'll have to come equipped with it's own copy of it. Attack vector lowered I guess... less can be more security. The less you have the less attack vectors there are...

 

[AMD1]

If malware wants to use it, it'll have to come equipped with it's own copy of it. Attack vector lowered I guess... less can be more security. The less you have the less attack vectors there are...

In that case I will disable it !!

 

[Ink]

what does this actually achieve by disabling it ?

Have a guess..? IE11 is an obsolete browser in the day of the modern web.

After the changes, C:/Program Files/Internet Explorer/ will remain, but no executable (iexplore.exe) or shortcuts in Start menu to run it.

Until Microsoft eradicate it completely from Windows 10, this is the closest method to removing IE.

 

[AMD1]

Spawn,
Thanks for the explanation. I did not appreciate IE11 was that out of date in this day and age.

 

[Deleted member 178]

You are using Edge so any sandboxing apps won't work with it since Edge uses its own sandboxing component called Appcontainer.

 

[ForgottenSeer 58943]

@AMD1
For Windows 10 user:
Internet Explorer can be Uninstalled (disabled) via Settings > Apps > Under (Apps & Features) > Manage optional features.

@Spawn - what does this actually achieve by disabling it ?

IE is an attack vector you don't want on your box IMO.

Also note, OSArmor has an option to block opening of IE, that's good enough without having to uninstall it, but uninstalling it only takes a moment. Occasionally, especially in the enterprise world we find Web Apps that REQUIRE IE still - believe it or not!

 

[shmu26]

Sandboxing is not just for your browser. Most modern browsers are pretty safe anyway, you don't hear much about browser exploits actually affecting people these days.

The more important use of sandboxing is for Office and PDF applications. This is where the really nasty exploits are happening.
Both Sandboxie and ReHIPS will sandbox such applications.
Sandboxie will do it if you set it up, and ReHIPS will do it out of the box.
(You don't need the paid version of ReHIPS for this, by the way.)

 

[harlan4096]

In general to run banking I use KTS + FireFox with K Safe Money, but I have also installed Sanboxie (Licensed) to run other applications.

I think part of the TAM behaviour can be emulated tweaking Application Control, but is not the same...

This thread has given me an idea: I will test the next malware samples at MWTHub with KTS2018 + Default settings + TAM On + PUP/PUA/AdWare/ and will see how it performs in dynamic tests...

 

[Deleted member 65228]

This thread has given me an idea: I will test the next malware samples at MWTHub with KTS2018 + Default settings + TAM On + PUP/PUA/AdWare/ and will see how it performs in dynamic tests...

My estimation is that it will perform amazingly.

 

[Deleted Member 3a5v73x]

In general to run banking I use KTS + FireFox with K Safe Money, but I have also installed Sanboxie (Licensed) to run other applications.

I think part of the TAM behaviour can be emulated tweaking Application Control, but is not the same...

This thread has given me an idea: I will test the next malware samples at MWTHub with KTS2018 + Default settings + TAM On + PUP/PUA/AdWare/ and will see how it performs in dynamic tests...

Pardon me, I am grateful for you testing Kaspersky, but I don't understand the point of testing it with TAM on, hunting for that 1 sample of 1000 that will slip by? Same question goes to for testing Comodo with auto-containment. Where's the catch? KTS with TAM on and Comodo with auto-containment is already 99.8% malware-protection.

 

[Deleted member 65228]

Pardon me, but I don't understand the point of it, hunting for that 1 sample of 1000 that will slip by? Same question goes to for testing Comodo with auto-containment. Where's the catch? KTS with TAM on and Comodo with auto-containment is already 99.8% malware-protection.

He is just going to test KTS with some things enabled to see how it performs, that's all. He wants to see if the system will be trashed or not with a quick test of it. It doesn't mean KTS is inhumanly good if it does well or inhumanly bad if it doesn't

The point is the same point everyone has for testing their products they use

The point is just he likes testing security products with malware lol

 

[harlan4096]

Right, just will try some malware packs with TAM On (which usually is disable by default) and check how it performs, some Kaspersky user ask about TAM from time to time in the forum, so there They will have some tests to check its behaviour

 

[shmu26]

Yeah, it's going to be hard to pin down the problem by running a few samples from the malware hub, because Kaspersky works too good, especially with TAM enabled.

I think the problem is that certain droppers are so common that they appear on the systems of a number of Kaspersky users, and so they get a semi-trusted rating in KSN, since they do nothing malicious in and of themselves.
Then, when no one is looking, they drop the payload...
This is only conjecture, I can't think of anything else.

 

[harlan4096]

If TAM didn't block the start, then the others protection modules will take action if necessary, anyway even with TAM On is not a panacea, fileless attacks are a different story...

 

[shmu26]

I like Sandboxie and not just for the sake that it increases security. I like it for the sake that when I close my browser, it will kill it's history and any pages loaded in it, so if I accidently get a cryptojacker that runs the browser minimized behind my clock, then once I purge the sandbox I purge the cryptojacker. No need to hunt down for the process or guess if it's on or not. When, I am done browsing I just purge the sandbox.

Also I have sandbox containers for each seperate web facing solutions and the box is setup to compartmentalize each solution within it's own sandbox. I.e. my VLC player can't talk to my chrome or see any drives besides what I tell it to see. My adobe reader is the same, etc etc etc.

I see it as just an elegant method of making sure that each program stays within their boundaries and that each one of them are running with dropped rights.

You know how to use SBIE right.
For those who are interested, ReHIPS does the compartmentalization automatically. But not the purging. That is SBIE's specialty.

 

[Deleted member 65228]

For those who are interested, ReHIPS does the compartmentalization automatically. But not the purging. That is SBIE's specialty.

Well on Chrome all it takes is a few clicks and boom the session data is gone lol