{"id":3788,"date":"2011-12-23T10:42:57","date_gmt":"2011-12-23T15:42:57","guid":{"rendered":"http:\/\/streamingradioguide.com\/startingover\/?p=3788"},"modified":"2011-12-23T10:46:13","modified_gmt":"2011-12-23T15:46:13","slug":"sandboxies-first-real-threat","status":"publish","type":"post","link":"https:\/\/streamingradioguide.com\/startingover\/?p=3788","title":{"rendered":"SandBoxie’s first real threat"},"content":{"rendered":"

\"\"<\/a><\/p>\n

For those playing along at home, I’ve been struggling with trying to find a reasonable way to protect my computer from random trojan \/ virus attacks as I wander bravely out onto the internet.<\/p>\n

Initiaully I started to use Fedora Linux for “dangerous” stuff – but now that disk drive is running the web site.\u00a0\u00a0 I still might go back to doing that.<\/p>\n

In the interim, I downloaded a program called SandboxIE<\/p>\n

http:\/\/www.sandboxie.com\/<\/p>\n

It’s apparently been around a while – it’s basically close to a rootkit, but that term carries a lot of baggage \ud83d\ude42\u00a0\u00a0\u00a0 What SandboxIE does is lets you start up any process inside the “Sandbox” – anything that process (or anything that process creates) stays stuck inside the sandbox.\u00a0\u00a0 It is blissfully unaware it it lives inside a fake Windows.\u00a0\u00a0 For you Linux fans, it’s roughly similar to a jailed chroot, but more thorough.\u00a0\u00a0 It’s watching updates to the registry, use of named pipes, probably many things I haven’t found het.\u00a0\u00a0\u00a0 When a program attempts to open a file with write access, the existing file is copied into the sandbox, so it looks “real”, but the original file is left protected outside the sandbox.<\/p>\n

Today, it got its first real test.\u00a0\u00a0\u00a0 While looking at a radio station web site (not hijacked, just hacked), Microsoft Security Essentials alerted to the thing up above….\u00a0 okay, here we go…\u00a0\u00a0 I told MSE to “clean” the system, which it did, then looked at the history of the attack up above.<\/p>\n

Look carefully at the filename of the location of the trojan and you’ll see the magic of sandboxie – MSE still alerts because it caught the trojan as it was being writtne to the sandbox – the fake C: drive within the C: drive<\/p>\n

Anything that happened from that point on (had MSE not caught it) would still be operating under the control of Sandboxie.\u00a0\u00a0 Any “damage” it did or attempts to modify the registry would still just be modifying the sandbox.<\/p>\n

http:\/\/www.stopbadware.org\/<\/p>\n

reports this site was first reported to them by Google almost a month ago, and apparently is still not secured.<\/p>\n

So, in conclusion it passed the first real test.\u00a0\u00a0\u00a0\u00a0 It’s free, it’s pretty easy to use, and so far hasn’t broken anything.\u00a0\u00a0\u00a0 If you are running Windows, it’s worth giving a try.<\/p>\n","protected":false},"excerpt":{"rendered":"

For those playing along at home, I’ve been struggling with trying to find a reasonable way to protect my computer from random trojan \/ virus attacks as I wander bravely out onto the internet. Initiaully I started to use Fedora … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,107],"tags":[],"class_list":["post-3788","post","type-post","status-publish","format-standard","hentry","category-about-the-guide","category-technology"],"_links":{"self":[{"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/posts\/3788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3788"}],"version-history":[{"count":4,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/posts\/3788\/revisions"}],"predecessor-version":[{"id":3794,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=\/wp\/v2\/posts\/3788\/revisions\/3794"}],"wp:attachment":[{"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/streamingradioguide.com\/startingover\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}