Hacker News Reader

Comment by antiviral | Hacker News Reader

Can any of you recommend a way to create a sandbox that can seal off processes within a computer?

One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money.

This article claims that Docker would also not be a good solution:

https://security.stackexchange.com/questions/107850/docker-a...

"...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this."

So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?

View on HN

If you are interested you should check out Qubes OS: https://www.qubes-os.org/

It uses xen hypervisor to then launch separate VMs for your different applications. Not an OS for everyone but I have been running it for some time and have had a good experience with it.

I had written a jail for Windows a long long time ago - it was inspired by Unix's jail.

For an app you could configure what filesystem and registry access was allowed and you could redirect FS access.

Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years.

I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.

Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area:

https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

On Linux-based systems, Firejail [1] is designed specifically for that (originally for Firefox?). However, it's had quite a few CVEs of its own, and I don't know how effective it is in practice protecting against 0-day-type problems.

I believe this is the idea behind Qubes OS. Any virtualization system (virtualbox or whatnot) should give you some protection, at the cost of some convenience.

Running with javascript disabled except on a small set of sites will also help protect against many attacks.

That's what Java applets were supposed to be originally, they were supposed to run in a sandbox....

Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.

If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations.

[1] http://www.securingjava.com/chapter-two/chapter-two-2.html

By total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html.

It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.

Reply on news.ycombinator.com