Advice Request Is sandboxie safe enough for malicious site video streaming

[Kingdiamond]

I am evaluating if i shall use sandboxie to surf malicious or adult site , with video streaming and some ads. I'm using Windows 10

Will the Adobe flash player or java script malware escape sandboxie environment and go into host system?

If i clear contents in sandboxie after every browsing sessions, is that safe enough?

Or is there any other setups that can be done to enhance safety?



I have read about shadow defender , it sound great and seem safest, but I'm a computer noob.
I'm scared after reading issues about incompatibilities causing problem etc etc. Therefore i thought sandboxie is a more friendly tool for computer illiterate person like me.

Your opinions are highly welcomed.
Thanks

 

[silversurfer]

I am evaluating if i shall use sandboxie to surf malicious or adult site , with video streaming and some ads. I'm using Windows 10

Will the Adobe flash player or java script malware escape sandboxie environment and go into host system?

If i clear contents in sandboxie after every browsing sessions, is that safe enough?

Or is there any other setups that can be done to enhance safety?

You looks like aware of the risk in general

AFAIK, it's almost impossible for malware to bypass Sandboxie. But you should better using maintained Sandboxie Plus/Classic:

Downloads | Sandboxie-Plus

Just harden even more your browser-sandbox, you will find inside settings of Sandboxie:
Internet Restrictions: only allow processes related to your browser, for instance: chrome.exe, firefox.exe, msedge.exe

 

[Kingdiamond]

You looks like aware of the risk in general

AFAIK, it's almost impossible for malware to bypass Sandboxie. But you should better using maintained Sandboxie Plus/Classic:

Downloads | Sandboxie-Plus

Just harden even more your browser-sandbox, you will find inside settings of Sandboxie:
Internet Restrictions: there only allow processes related to your browser, for instance: chrome.exe, firefox.exe, msedge.exe

View attachment 262048View attachment 262049

Haha, yes I'm aware of the risk LOL

I had just read that sandboxie after 2019 will have compatibility issues with Windows 10, the 64 bit version.

So will i have issues using sandboxie plus?
By setting Internet restrictions for only, eg chrome.exe, does such restrictions stop the video streaming or stop the javascript or flash player from working on video streaming?

 

[silversurfer]

So will i have issues using sandboxie plus?
By setting Internet restrictions for only, eg chrome.exe, does such restrictions stop the video streaming or stop the javascript or flash player from working on video streaming?

For now Sandboxie Plus should running flawless on Windows 10, because it's still being maintained and any issues can be reported to developers:

GitHub - sandboxie-plus/Sandboxie: Sandboxie Plus & Classic

Sandboxie Plus & Classic. Contribute to sandboxie-plus/Sandboxie development by creating an account on GitHub.

github.com

Both javascript and flash player works as usual. However, in case Sandboxie-Plus works by default with notifications for permissions to allow internet access for certain processes, but avoid to allow every process what appears, just allow what is related to browsing session for your video streaming...

 

[VladDracul]

I wouldn't say that you are a noob.If you are up to configure and use Sandboxie for safebrowsing I would say that Shadow Defender is easier to use.I use it on a Windows 10 laptop and now on Windows 11 without any problems.

 

[silversurfer]

Just to mention the downside using Shadow Defender, your personal data can be stolen by hackers, Shadow Defender can't protect against something like that but you can more restricted your personal data by using tweaked Sandboxie.
For video streaming of sports or other stuff... I would using Shadow Defender on my former PC (weak Hardware), there are not stored personal data.

 

[Kingdiamond]

For now Sandboxie Plus should running flawless on Windows 10, because it's still being maintained and any issues can be reported to developers:

GitHub - sandboxie-plus/Sandboxie: Sandboxie Plus & Classic

Sandboxie Plus & Classic. Contribute to sandboxie-plus/Sandboxie development by creating an account on GitHub.

github.com

Both javascript and flash player works as usual. However, in case Sandboxie-Plus works by default with notifications for permissions to allow internet access for certain processes, but avoid to allow every process what appears, just allow what is related to browsing session for your video streaming...

View attachment 262054

Thank you for your reply.

In the case of Sandboxie asking for permissions to allow video streaming, apart from browsers , i would assume sandboxie will need permission to run javascript or flash player , which shall be .exe form as well?
So when we javascript and flash player to run, is there any malware risk transmitted though this?

 

[Kingdiamond]

Just to mention the downside using Shadow Defender, your personal data can be stolen by hackers, Shadow Defender can't protect against something like that but you can more restricted your personal data by using tweaked Sandboxie.
For video streaming of sports or other stuff... I would using Shadow Defender on my former PC (weak Hardware), there are not stored personal data.

In shadow defender, only time data can be stolen would be during Internet live connection and everything will be erased once shutdown and reboot.

What kind of retweaking needs to be done in Sandboxie to avoid personal data to be stolen?

 

[Kingdiamond]

I wouldn't say that you are a noob.If you are up to configure and use Sandboxie for safebrowsing I would say that Shadow Defender is easier to use.I use it on a Windows 10 laptop and now on Windows 11 without any problems.

My only concern on Shadow defender shadow mode is that, i have read quite a number of complains elsewhere that their computer run into compatibility issues.
Such as window update reboot koop, and some other issues.

I lack knowledge in computer and trouble shooting. Such situations scares me

 

[silversurfer]

In the case of Sandboxie asking for permissions to allow video streaming, apart from browsers , i would assume sandboxie will need permission to run javascript or flash player , which shall be .exe form as well?
So when we javascript and flash player to run, is there any malware risk transmitted though this?

You have to try what exactly with Sandboxie must be allowed to watch your video streaming, depends even on different browsers.

Javascript is well-known to be abused by certain malware variants, that was what I meant "aware of the risk in general"
Always highest risk to watch this kind of streaming (sports, movies, p...). Legal streaming services are always safer and more controlled

What kind of retweaking needs to be done in Sandboxie to avoid personal data to be stolen?

As I said before => Sandbox Options => Internet Restrictions: only allow processes related to your browser, for sure: chrome.exe

 

[Kingdiamond]

When we browse malicious sites using sandboxie, which is the preferred browser?
Chrome, Edge or Firefox?

 

[Freki123]

Afaik flash is dead for month. When I see a site using that I just look for an alternative site (while using sandboxie and having offline backups).

 

[Zorro]

I am evaluating if i shall use sandboxie to surf malicious or adult site , with video streaming and some ads. I'm using Windows 10

Streaming video from an adult site? Here you need to use Tails at a time to be sure that you have not become infected.

 

[struppigel]

I am evaluating if i shall use sandboxie to surf malicious or adult site , with video streaming and some ads. I'm using Windows 10

Will the Adobe flash player or java script malware escape sandboxie environment and go into host system?

If i clear contents in sandboxie after every browsing sessions, is that safe enough?

Or is there any other setups that can be done to enhance safety?



I have read about shadow defender , it sound great and seem safest, but I'm a computer noob.
I'm scared after reading issues about incompatibilities causing problem etc etc. Therefore i thought sandboxie is a more friendly tool for computer illiterate person like me.

Your opinions are highly welcomed.
Thanks

I definitely suggest you to use a VM, e.g., VirtualBox, instead.
Sandboxie is better than nothing in regards to protection but unsafe to use for malware contact on a regular basis, which is what seems to be the case here.

The reasons are described in papers like these:

https://bromiumlabs.files.wordpress.com/2013/07/application_sandboxes_a_pen_tester_s_perspective2.pdf

"The default installation of Sandboxie did not prevent any keylogging whatsoever. The attacker had full access to the key logging activity of the entire machine."

"Sandboxie allows access to the network shares from within the sandbox."

"Sandboxie was not able to prevent stealing from the clipboard and the attacker had full access to the victims host clipboard. "

"Our testing proves that due to the large exposure to the OS, a lot of sandboxes aren't able to completely protect against undesired access. This is indeed a concern since these sandboxes are designed to expect execution of 'untrusted' code."

https://paper.bobylive.com/Meeting_Papers/BlackHat/Europe-2013/bh-eu-13-thes-sandbox-wojtczuk-slides.pdf

"sandboxed code has direct access to almost full OS functionality" "Almost all kernel vulnerabilities are exploitable from within this sandbox"

"This sandbox has no means to contain malicious kernel-mode code (because they both run at the same privilege level)"

I am not aware what new features were implemented since these papers were published, but the most interesting takeaway of that: The weaknesses it has are by design of that technology. They cannot just be eradicated.
--> see first paper: "Type A sandboxes by design, are vulnerable to a relatively large attack surface."
Sandboxie is a type A sandbox.

 

[Kingdiamond]

Streaming video from an adult site? Here you need to use Tails at a time to be sure that you have not become infected.

Sorry for lacking knowledge.
What is Tails and how do you use it to track and see if any infections?

 

[Kingdiamond]

I definitely suggest you to use a VM, e.g., VirtualBox, instead.
Sandboxie is better than nothing in regards to protection but unsafe to use for malware contact on a regular basis, which is what seems to be the case here.

The reasons are described in papers like these:

https://bromiumlabs.files.wordpress.com/2013/07/application_sandboxes_a_pen_tester_s_perspective2.pdf

https://paper.bobylive.com/Meeting_Papers/BlackHat/Europe-2013/bh-eu-13-thes-sandbox-wojtczuk-slides.pdf

I am not aware what new features were implemented since these papers were published, but the most interesting takeaway of that: The weaknesses it has are by design of that technology. They cannot just be eradicated.
--> see first paper: "Type A sandboxes by design, are vulnerable to a relatively large attack surface."
Sandboxie is a type A sandbox.

Thanks for sharing the paper. Looks like a concern.
I'm going to have to look up at virtual box and see if it is hard to handle

 

[HarborFront]

When we browse malicious sites using sandboxie, which is the preferred browser?
Chrome, Edge or Firefox?

I think you should be looking at a secure browser for privacy. Read below

10 Best Web Browsers for Privacy, Security, & Speed 2024

Secure your online activity with the best web browsers for privacy. Stay safe and anonymous - see which services are the best web browsers for privacy!

www.wizcase.com

Quick Comparison Table: Which Browser Is the Most Secure in 2021?​

Secure Browser	Security	Privacy	Extensions	Platforms
1. The Onion Router (Tor)	Excellent	Excellent	Some	No iOS
2. Ungoogled Chromium	Excellent	Excellent	Some	No iOS or Android
3. Epic Privacy Browser	Good	Good	Some	All
4. Mozilla Firefox	Good	Good	Many	All
5. Brave	Excellent	Excellent	Some	All
6. Apple Safari	Good	Average	Some	Mac and iOS
7. Vivaldi	Good	Average	Many	No iOS
8. Opera	Good	Average	Many	No iOS
9. Google Chrome	Good	Below Average	Many	All
10. Microsoft Edge	Average	Average	Some	All

Actually, Ungoogled Chromium (Eloston) can use 'Many' Chrome extensions just like Google Chrome and not 'Some'. Other variants of Ungoogled Chromium (although updates frequently) do connect to Google at a larger extent than Eloston's Ungoogled Chromium.

The table does not include Librewolf browser which should put it somewhere with Ungoogled Chromium as 'Excellent', Excellent', 'Many'

IMO, having a hardened FF should be better than Epic Privacy Browser

 

[upnorth]

I definitely suggest you to use a VM, e.g., VirtualBox, instead.
Sandboxie is better than nothing in regards to protection but unsafe to use for malware contact on a regular basis, which is what seems to be the case here.

Thanks for sharing the paper. Looks like a concern.
I'm going to have to look up at virtual box and see if it is hard to handle

I agree with @struppigel as using SB if you genuine plan to regular visit/test unsafe sites, is not a recommended platform. VirtualBox, VMware Player or also Windows own Hyper-V is a much better option, but Hyper-V got a bit steeper learning curve. Please just don't forget a VPN.

Avoid save account/private information no matter what browser you use. All those can still be lost even in a Virtual Machine.

If you ever would get a bit more curious and want to learn more, I can highly recommend AnyRun.

Interactive Online Malware Analysis Sandbox - ANY.RUN

Cloud-based malware analysis service. Take your information security to the next level. Analyze suspicious and malicious activities using our innovative tools.

app.any.run

 

[ForgottenSeer 92963]

Quick Comparison Table: Which Browser Is the Most Secure in 2021?​

I used the following criteria to evaluate each browser:

1. Advanced security features: Secure browsers should have zero weak spots for hackers to exploit, and regularly update their defensive features.
2. Strong privacy policy: Your data shouldn’t be tracked, shared or sold to make money. At the very least, you’ll have the option to opt-out of data collection and any other practices that breach your privacy.
3. Support for secure extensions: Extensions can boost your browser’s functionality, but not every extension is secure or private. Some will even track everything you do during a browsing session. Secure browsers should block any extensions that may compromise your device’s security.
4. Multi-platform support: Browsers need to be compatible with Windows, Android, Mac, iOS devices, and other popular devices.

Above is a very, very, very limited set of evaluation criteria AND they are not applied correctly, so a sad case of framed information posting

Shooting from the hip, here are just a few comments

Security
1. Just compare the per-site settings of Chromium based browsers versus other browsers.

1. When Edge is average security wise, what about the security features of Edge which other Chromium based browsers do not have like"
a) de-elevation on start of the broker process
b) code integrity guard applied on the renderer processes
c) super duper secure mode

Privacy
2. Unless you use a Tor-browser configured correctly (Tor-wiki advised to NOT use VPN because configuring it correctly requires advanced skills which most people using Tor fail to have), total privacy is a lost case. So when evaluating the author should show his understanding of the marketing mechanisms by telling which tracking mechanisms are applied most and what he considers stage-1, stage-2 and stage-3 privacy protection. I don't see these criteria specified anywhere in the post of Benjamin Walsh

2. Opera is considered average, but it has a build in VPN-proxy which obfuscates the IP-addres

Support for secure extensions
3. There only a few browsers with their own extension store. It is hilarious to read that he rates the browsers not on their efforts to provide secure extensions, but the number of extensions in the different browser stores, so he is not even evaluating against his own criteria

Multi-platform support
Mr Benjamin Walsh I have got news for you. Most multi-platform ease of use benefits are only provided when you log-in or use the browsers cloud storage for syncing. This makes it very very very very very very very very very very (how much times should I repeat this) very very very very very very very easy to track you over different devices, especially browsers with their own advertising schemes.
___________________________________________

Thanks posting Mr Benjamin Walsh "most secure browser analysis", I have not laughed that hard for ages

 

[ForgottenSeer 92963]

@Kingdiamond

When you want to use a virtualized browser the easy way: buy Windows Pro license for a few bucks and enable Edge Application Guard

Microsoft Edge and Microsoft Defender Application Guard

Microsoft Edge support for Microsoft Defender Application Guard

docs.microsoft.com