Reply to thread

Message

<blockquote data-quote="Evjl&amp;#039;s Rain" data-source="post: 711890" data-attributes="member: 51905">after watching several videos CS has posted, I know CF is one of the best, if not the best security tool to lockdown the system. I&#039;m no longer impressed anymore because CF does what it can dohowever, I think should be used in a different way other than executing a malware inside the sandbox, as Sunshine-boy said, we don&#039;t notice any malicious activity inside the sandbox, unless the malwares are cryptominers, crash or spawn so many processes that can be noticed. Because of CS&#039;s settings, even safe apps with an UI can crash and show nothingI think CF should be used as following:1/ exploit shield, when malwares try to download their payloads, CF will block them =&gt; something is clearly malicious and deserves user&#039;s intervention2/ When an user executes a random file- if CF allows the file to run because it is whitelisted by cloud or TVL =&gt; let the file runs- if the file is sandboxed and crashes due to CS&#039;s configuration (untrusted or highly restricted), the file can either be safe or malicious. The user has to do several steps to determine the safety of that file (VM, VT, hybrid-analysis, sandboxie without no restriction,...) or pray and run the file outside the sandboxfor now, I&#039;m using CF&#039;s sandbox as an exploit shield to block malware payloadsCF is extremely prone to FPs, especially for non-english, french or spanish applications (non-commonly speaking languages). In fact, I had to whitelist at least 10 times per day when I was installing or updating my applicationsthe 2/ is clearly not for average users and it&#039;s not security, it&#039;s troublemaker</blockquote>

[QUOTE="Evjl's Rain, post: 711890, member: 51905"] after watching several videos CS has posted, I know CF is one of the best, if not the best security tool to lockdown the system. I'm no longer impressed anymore because CF does what it can do however, I think should be used in a different way other than executing a malware inside the sandbox, as Sunshine-boy said, we don't notice any malicious activity inside the sandbox, unless the malwares are cryptominers, crash or spawn so many processes that can be noticed. Because of CS's settings, even safe apps with an UI can crash and show nothing I think CF should be used as following: 1/ exploit shield, when malwares try to download their payloads, CF will block them => something is clearly malicious and deserves user's intervention 2/ When an user executes a random file - if CF allows the file to run because it is whitelisted by cloud or TVL => let the file runs - if the file is sandboxed and crashes due to CS's configuration (untrusted or highly restricted), the file can either be safe or malicious. The user has to do several steps to determine the safety of that file (VM, VT, hybrid-analysis, sandboxie without no restriction,...) or pray and run the file outside the sandbox for now, I'm using CF's sandbox as an exploit shield to block malware payloads CF is extremely prone to FPs, especially for non-english, french or spanish applications (non-commonly speaking languages). In fact, I had to whitelist [B]at least 10 times per day[/B] when I was installing or updating my applications the 2/ is clearly not for average users and it's not security, it's troublemaker [/QUOTE]

Verification