Free virtualization software gets the nodLast month’s editorial on safe surfing drew a big response from subscribers. In particular, folks just raved about Sandboxie, the free utility that allows you to safely surf the net in a virtual layer on your PC.
Colin Drew’s email was typical: "Gizmo, it’s just like you said. This Sandboxie thing has changed my whole attitude to surfing. I’m no longer afraid where I go on the web or paranoid about downloading and trying out new stuff."
For those who missed last month’s issue, Sandboxie is a freeware utility for users of Windows 2000 and later that creates a special contained "sandbox" environment on your PC. While browsing within the virtual sandbox provided by Sandboxie you are totally corralled off from other parts of your PC. Any files you download are isolated to the sandbox. Similarly, any programs that are executed only do so within the sandbox and have no access to your normal files, the Windows operating system or any other part of your PC.
A number of products offer similar capabilities to Sandboxie but the feature that distinguishes it from most of these is that it can be launched right from your desktop with no re-booting. That’s a really big plus.
Usage is remarkably simple. To start a sandboxed browsing session you just click the Sandboxie icon in from the Quick Launch tray and this will launch your default browser in the sandbox. You can then use it in the normal way to browse to sites or download files.
If you run a downloaded file it will install normally but again will be corralled off from your real PC. Any files it writes to your hard drive, any changes to the Windows Registry or changes to the Windows startup will be held in a separate area within the sandbox. Similarly, any new processes running in your computer memory will be sandboxed.
After you have finished browsing you can right click the Sandboxie icon and delete all sandboxed files and processes and your PC will be returned to the exact same state it was in before the browsing session.
The advantage is clear: any spyware, trojans, keyloggers or other malware products that infected your PC while browsing will be eliminated.
It’s an attractive idea and I can see why so many subscribers have been so enthusiastic about Sandboxie.
Now, with all you folks putting such faith in the product I feel I need to say a little more about Sandboxie and to answer a few questions.
First, how safe is Sandboxie?
I’ve done some more testing with Sandboxie to see how well it isolates your "real" PC from infection. These were tough tests involving visits to drive-by download sites that utilized Windows flaws to install up to 50MB of particularly nasty malware. Additionally, I installed a number of rootkit-disguised spyware programs, two keyloggers and a RAT trojan as well.
I’m happy to say Sandboxie provided full protection. Once I stopped all sandboxed processes and erased all sandboxed files, there were no active malware products left on my PC.
I’m not saying that Sandboxie provides 100% total protection; no single security product can provide that. What I can say from my testing is that Sandboxie provides a level of protection so high that you can use it with full confidence.
Even if you use Sandboxie for all your browsing you still need other security software installed on your PC: an antivirus scanner, an anti spyware scanner, a firewall and more. As I said, no security product is perfect, Sandboxie included. That’s why you need several layers of defense just in case Sandboxie fails.
A second question I need to clarify about Sandboxie is its privacy.
Because Sandboxie erases all traces of a browsing session, it’s clearly a good way of enhancing your privacy. Any record of the sites you visited and any files you downloaded will be erased.
Well, not quite. While all sandboxed files may have been deleted they could be undeleted by a skilled operator in the same way any deleted file on your PC may be recovered.
This may not be likely but it’s quite possible. If you want to truly erase deleted Sandboxie material then you should clean your hard drive "unused" space after browsing using a forensic level file deleter such as the open source program "Eraser."
But even that won’t guarantee complete privacy. There may be records of your browsing session at your ISP, your company’s server and at the sites you visited.
This privacy risk is very small but can be reduced by using a free anonymizing service like Tor or Jap while browsing with Sandboxie. Reduced yes, but eliminated, no. Nothing you do on the Internet should ever be considered absolutely 100% private and confidential. Yes, the risk of disclosure is minute, but never engage in any internet activity based on the assumption that they can never be found out by a law enforcement authority or other agency with privileged access.
See you next month.
Sandboxie: Free for non-commercial use, Windows 2000 and later, 310KB.http://www.sandboxie.com
