- Apr 13, 2013
- 3,140
A very short video in reference to a current War Room discussion:
Sandboxes against a simple API exploit
- Thread starter cruelsister
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
- Sep 13, 2014
- 874
I like your quick tests very much
seems sadboxie need improvments...
one time, I run a ransomware in sandboxie as a result the malware block all my system, He got through the Sandboxie protection
seems sadboxie need improvments...
one time, I run a ransomware in sandboxie as a result the malware block all my system
, He got through the Sandboxie protection
- May 26, 2014
- 1,339
Hi Cruelsister, how about Qihoo 360 sandbox? Is it good?
Comodo Autosandbox was on default settings?
Coz couple months back in one of my thread in Comodo software category I have mentioned deletevolume.exe (harmless sample) from testmypcsecurity site on execution is autosandboxed by Comodo & secondary drive gets deleted. And if I remember correctly you have replied could happen with default settings (not sure about your reply I have mentioned here). I will try to search the thread & reply here.
Update - I couldn't find the thread now. Anything changed regards to Autosandbox default like rules, etc... that secondary drive deletion were protected in your video?
I remember CIS version I had tested...AS default was Full Virt.
Coz couple months back in one of my thread in Comodo software category I have mentioned deletevolume.exe (harmless sample) from testmypcsecurity site on execution is autosandboxed by Comodo & secondary drive gets deleted. And if I remember correctly you have replied could happen with default settings (not sure about your reply I have mentioned here). I will try to search the thread & reply here.
Update - I couldn't find the thread now. Anything changed regards to Autosandbox default like rules, etc... that secondary drive deletion were protected in your video?
I remember CIS version I had tested...AS default was Full Virt.
Last edited by a moderator:
- Apr 13, 2013
- 3,140
Guess I should have specified that I was using my suggested settings- sandboxed processes as Untrusted. As there is no reason not to harden the Box in this way- Not making this change is like never taking a Lamborghini out of First gear.
Tony- the issue with scripts in general is many Security products can't distinguish a legitimate script from a malicious one. This is a severe issue in the Enterprise space, and the cause of most of the recent breaches (and also the reason why many Corporations are switching from Traditional protection to solutions based on virtualization like FireEye and Palo Alto).
Tony- the issue with scripts in general is many Security products can't distinguish a legitimate script from a malicious one. This is a severe issue in the Enterprise space, and the cause of most of the recent breaches (and also the reason why many Corporations are switching from Traditional protection to solutions based on virtualization like FireEye and Palo Alto).
So you maxed CIS settings.
Did you maxed Sandboxie settings too?
- Apr 13, 2013
- 3,140
Ok.
You test mostly modified CIS settings...thats good as it shows the power of CIS.
But would be good to see tests with default settings too... as there are many users like me those go with default settings & would like to see how default settings does against any/all threats....& default settings are kind of recommended settings for majority so defaults should be put to test more.
- Feb 7, 2014
- 1,540
But if you were following what Cruelsister post you will have found out that she don't recommend using default settings & why.
Salutations,Friends!
http://malwaretips.com/threads/comodo-8-2-0-4674.49303/#post-419285
http://malwaretips.com/threads/sandboxie-not-working-on-windows-10.49013/#post-416690
Comodo seem to have the upper hand. I will few tests on Windows 10 tonight! Then, I will let you
know my decision. Look like I will keep Comodo Firewall and uninstall SandBoxie!
http://malwaretips.com/threads/comodo-8-2-0-4674.49303/#post-419285
http://malwaretips.com/threads/sandboxie-not-working-on-windows-10.49013/#post-416690
Comodo seem to have the upper hand. I will few tests on Windows 10 tonight! Then, I will let you
know my decision. Look like I will keep Comodo Firewall and uninstall SandBoxie!
- Apr 3, 2014
- 1,460
sorry but SB has many options especially in the restriction tab. the default sandbox is mostly made for browsers , to test such malware it should be done with tweaks adapted to it.
depends what kind of sandbox you want use.
at least you should tick "drop rights from administrator..."
hi, like umbra said using and restriction setting of it depends on how you configure and based on your liking. if you asking me it is same like using and understanding how comodo works.nothing to add more on this learning curve, nobody will became perfect in one day, it will take years to become one, so have patience and fun in learning, only personal experience is the best teacher.
ps: if you learn how to use anti executable then you can understand what is happening in your pc then you will in full control over your system and understand if there is some thing wrong in it. this is not a joke but i pain full path nobody wants to take.
not to say that Sandboxie is incompatible with Comodo sandbox. (well known fact on both Comodo and sandboxie forums)
You can see that the tray icon of Sbie doesnt keep the red dots (meaning no sandboxing is applied).
i sufffered this bug when i installed CIS and Sbie, Sbie couldn't protect my browser; in fact it even didn't start at all.
i didn't pay attention that both was running when i wrote my post earlier. it is by reading @Av Gurus' comment that i saw the issue.
so basically the test is irrelevant for checking Sbie protection. Sbie should have been tested alone with proper settings.
You can see that the tray icon of Sbie doesnt keep the red dots (meaning no sandboxing is applied).
i sufffered this bug when i installed CIS and Sbie, Sbie couldn't protect my browser; in fact it even didn't start at all.
i didn't pay attention that both was running when i wrote my post earlier. it is by reading @Av Gurus' comment that i saw the issue.
so basically the test is irrelevant for checking Sbie protection. Sbie should have been tested alone with proper settings.
do you believe she going to accept it, well i do not know, but again, you know the answer.
Similar threads
