Reply to thread

Message

<blockquote data-quote="Deleted Member 308817310" data-source="post: 822062" data-attributes="member: 80647">The end user is vulnerable to spying within the guest environment which can be discarded at the end user&#039;s discretion. This is obviously implied. I stated that Hyper-V doesn&#039;t stop malware for a reason - I didn&#039;t think that I&#039;d have to literally outline every singe thing that malware could to do an end user when it&#039;s on a guest environment.If a browser under Sandboxie does become compromised by an RCE vulnerability (there&#039;s been a recent one for Google Chrome that wasn&#039;t patched in the release for a few weeks and there was recently a Firefox sandbox escape) then an attacker can deploy a botnet attack without leaving the context of the browser. So, bad things can happen whilst a browser is under Sandboxie as well. I didn&#039;t think this needs to be explicitly implied either until now.People have tried to exploit Sandboxie during it&#039;s prime time to shine and they succeeded. When Sandboxie was of interest in the market (not just within these forums), security researchers took it on and succeeded. You can google for old Sandboxie bypasses between 2010-2014 when it was of interest to people. I&#039;m not doing your homework for you.For everything that Sandboxie cannot officially and ethically do on the environment from a kernel-level, it moves to using rootkit techniques like from the books of the early 2000s but in user-mode. It takes the easy way out instead of doing things the proper way for isolation... which these days, would be leveraging CPU features explicitly designed for such use cases.Sandboxie messes with the memory of processes belonging to other people&#039;s software which also makes the threat surface raise for the products being put under the sandbox. Furthermore, Sandboxie tarnishes code integrity which is there for a good reason: to help make sure that an attacker hasn&#039;t been messing with memory to control things.You do not need to pretend to understand it because the fact you&#039;re still trying to change my opinion and voice the impression that there&#039;s little difference between Microsoft&#039;s sandbox technology and Sandboxie evidently proves that you do not understand my points. At this point, you may never understand my points. I&#039;m fine with that. I&#039;m content with it.</blockquote>

[QUOTE="Deleted Member 308817310, post: 822062, member: 80647"] The end user is vulnerable to spying within the guest environment which can be discarded at the end user's discretion. This is obviously implied. I stated that Hyper-V doesn't stop malware for a reason - I didn't think that I'd have to literally outline every singe thing that malware could to do an end user when it's on a guest environment. If a browser under Sandboxie does become compromised by an RCE vulnerability (there's been a recent one for Google Chrome that wasn't patched in the release for a few weeks and there was recently a Firefox sandbox escape) then an attacker can deploy a botnet attack without leaving the context of the browser. So, bad things can happen whilst a browser is under Sandboxie as well. I didn't think this needs to be explicitly implied either until now. People have tried to exploit Sandboxie during it's prime time to shine and they succeeded. When Sandboxie was of interest in the market (not just within these forums), security researchers took it on and succeeded. You can google for old Sandboxie bypasses between 2010-2014 when it was of interest to people. I'm not doing your homework for you. For everything that Sandboxie cannot officially and ethically do on the environment from a kernel-level, it moves to using rootkit techniques like from the books of the early 2000s but in user-mode. It takes the easy way out instead of doing things the proper way for isolation... which these days, would be leveraging CPU features explicitly designed for such use cases. Sandboxie messes with the memory of processes belonging to other people's software which also makes the threat surface raise for the products being put under the sandbox. Furthermore, Sandboxie tarnishes code integrity which is there for a good reason: to help make sure that an attacker hasn't been messing with memory to control things. You do not need to pretend to understand it because the fact you're still trying to change my opinion and voice the impression that there's little difference between Microsoft's sandbox technology and Sandboxie evidently proves that you do not understand my points. At this point, you may never understand my points. I'm fine with that. I'm content with it. [/QUOTE]

Verification