Original subtitles

1

Let’s go through some sandbox applications

2

you could use to protect your applications

3

that interact with untrusted sources, such as the internet.

4

Particularly, you want to sandbox your browser

5

and email client as a minimum.

6

So Windows sandboxes first.

7

Have a look at this video on Bufferzone. It’s a commercial sandbox,

8

but the video will give you a good idea

9

of the sort of functionality that sandboxes offer.

10

Welcome to Bufferzone.

11

In this demo, we’ll show you how Bufferzone virtual container technology

12

blocks ransomware and other exploits,

13

prevents them from accessing your files,

14

and keeps them from infecting other users in your organization.

15

We received this ransomware inside an email attachment.

16

It’s embedded in a word file that looks harmless.

17

When you open the file,

18

the malware silently downloads onto the computer.

19

By the time you realize that the file isn’t legitimate and close it,

20

it’s too late.

21

At this point, the malware keeps quiet,

22

so a lot of users would decide that the file was just spam,

23

but in fact, the ransomware is busy working in the background

24

locking our files.

25

10 minutes later,

26

the ransom note arrives threatening to destroy

27

the encryption keys if we don’t follow their instructions.

28

When we click on show files,

29

we see a list of all the files on the disk that were supposedly encrypted.

30

No worries. We are protecting email attachments with Bufferzone.

31

The infected word file was opened in an invisible virtual container.

32

When Word is running inside the container,

33

it is actually segregated from the file system,

34

the registry, and the computer’s memory.

35

When the ransomware tried to access our files,

36

they were copied into the container.

37

The ransomware has encrypted the copy,

38

but our original files are safe.

39

If the exploit tried to write to the registry or memory,

40

it would also be fooled into accessing the virtual copy.

41

The Bufferzone container is also segregated from the network,

42

so the ransomware cannot get out to infect other computers.

43

To eliminate the ransomware,

44

we simply empty the Bufferzone container.

45

You see that the encrypted files are gone,

46

but the original files remain.

47

Bufferzone’s patented containment technology

48

provides protection from phishing scams, drive-by downloads,

49

malvertising, zero-day exploits, and many other types of advanced malware.

50

It enables you to browse the internet, open email attachments,

51

and open files from removable media safely.

52

Try Bufferzone today. Learn more –

53

So there you are. This product looks good,

54

but I haven’t comprehensively tested it.

55

It looks like they’re aiming at the business market though

56

and not for personal use,

57

but it looks like a very good product for Windows only.

58

Another sandbox type of technology is Shadow Defender.

59

Shadow Defender can run your system in a virtual environment

60

which they call the shadow mode.

61

Shadow mode redirects each system change to a virtual environment

62

with no changes to the real environment.

63

Not tested this one. This is Windows only.

64

Another sandbox-like tool that works slightly different is Deep Freeze.

65

And Deep Freeze is a kernel level driver

66

that protects the hard drive integrity

67

by redirecting information being written to the hard drive partition,

68

leaving the original data intact.

69

This redirected information is no longer referenced

70

once the computer is restarted,

71

thus restoring the system to its original state at the disc sector level.

72

So essentially what this is doing

73

is making sure that every time your system reboots,

74

it restores to exactly the same state.

75

This works on Windows, Mac, and Linux versions are available.

76

But know, with this type of sandboxing,

77

there’s no protection until you reboot.

78

So an attacker, for example, could read your files with malware

79

until you actually do the reboot,

80

and then when you do the reboot, the malware will no longer exist.

81

There is also the Deep Freeze cloud browser and desktop.

82

Another kind of sandbox is Returnil.

83

This creates a cloned version of your system partition

84

to boot from and then work within.

85

If anything does go wrong during your session,

86

you reboot the system and the operating system environment

87

is returned back to where it was

88

before you turned Returnil protection on.

89

But note that there is no protection until you do that reboot,

90

so an attacker could be reading your files with malware

91

or keylogging until you actually do that reboot.

92

But once you do the reboot, your system is returned to normal

93

and any malware or hacker will be removed.

94

And this is what it looks like.

95

It isn’t just a sandbox or virtual environment;

96

it also has additional features including files protection

97

and an anti-executable function.

98

It’s free for private use only.

99

The free Comodo firewall

100

comes with a built-in sandbox and virtual desktop.

101

The Comodo firewall is a good tool,

102

but Comodo lately has made some mistakes

103

with some of their security products,

104

so I don’t have a great deal of faith

105

in this sandbox and virtual desktop.

106

Some antivirus offer sandboxing functionality like Avast antivirus,

107

although I don’t recommend this as Avast are known to sell your data.

108

Bitdefender also has Safepay

109

which is a limited functionality browser providing sandboxing.