Sandbox security versus the evil Web

1 comment | 5I like it!
September 30, 2008, 02:45 PM —  InfoWorld — 

The Internet is a scary place. Criminal malware lurks on legitimate and illegitimate Web sites alike, looking to steal your money one way or the other. Vendors have been scratching their collective heads attempting to make more consumers safer, more often. One of the results has been a class of anti-malware software that I call sandbox protection products. These items encapsulate Internet browsers (and e-mail programs and sometimes any other program you can run) within a virtual, emulated cocoon designed to keep malware from reaching and modifying the underlying host computer.

It used to be that you had to boot with an infected floppy diskette, run an infected executable, or double-click on an e-mail attachment to get exploited. Nowadays, all you have do is surf your browser across the wrong Web page, or the right Web page at the wrong time. Client-side, polymorphic, Internet browser-based exploits account for the large majority of malware infections. And although nearly ubiquitous in use, conventional anti-virus, anti-spam, and host-based firewalls are being challenged as never before to provide protection. In the virtual world, malware can be controlled, limited, and defanged. If the vendor does its job perfectly, everything legitimate the end-user wants to keep is kept permanently, and all traces of malware are erased as if the exploit never occurred.

As this review will show, none of the current solutions are perfect, but they do have value as an additional line of defense. I tested five products: Check Point Software's ZoneAlarm ForceField, Sandboxie, Prevx, Authentium's SafeCentral, and Softsphere Technologies' DefenseWall HIPS. Trusteer declined our invitation to participate, and one of the original pioneers in this field, GreenBorder Technologies, has been purchased by Google and is unavailable for review. I intentionally wanted to cover products that would be new to most of our readers and that have not been reviewed multiple times in the past.

Each product was tested by subjecting it (and the underlying host running Microsoft Windows XP Professional SP2, Internet Explorer 6, Firefox 1.0, and several older versions of browser add-on software) to hundreds of malicious Web links. Unpatched application software was intentionally used to test the defensive capabilities of the reviewed products. I didn't want the latest vendor patches stopping the malware. I wanted the sandbox products to do all the hard work.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

I like it!
Close

On Twitter now

security

Powered by Twitter
You are logged in | Sign out
Sign in and post to Twitter

What are you thinking?

Cancel Tweet sent

On Twitter now

Comments

More Effort Needed

These products work well when the malware has been circulating for a while and their behavour becomes known. Very few are able to detect new malware unless the malware does something obvious and even then most rely on a warning to the un-security educated user to make a decision.

As we know the malware writers are much more organized bunch of people, writing some very sophisticated code. It's time the industry stopped waving a fly swot at the charging bull and focused on intelligent solutions to this problem.

The vast bloated software from the AV industry which degrades the system performance, corrupts the OS and generally provides a false sense of security isn’t good enough. The products in this review at least make an attempt to improve security but still at the cost of vast numbers of users getting infected before the products understand the behaviour to start protecting. This still isn’t good enough.

Analysing program execution in real time is the only method that will detect malware in sufficient time to be effective and it is this direction the industry should put more effort.
| reply
peer-to-peer

Esther Schindler
If the comments are ugly, the code is ugly

claird
SVG a graphics format for 21st century

pasmith
Take Chrome OS for a test spin

Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?

sjvn
64-bits of protection?

jfruh
Android fragments vs. the iPhone monolith

mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive

 

Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325

Join the conversation here

The Daily Tip

The Daily TipQuick, practical advice for IT pros. Made fresh daily.

Hot tips:

Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.

Newsletters

Subscribe to ITWORLD TODAY and receive the latest IT news and analysis.

I would like to receive offers via email from ITworld partners.
By clicking submit you agree to the terms and conditions outlined in ITworld's privacy policy.
Featured Sponsor

AISO founders envisioned a Web hosting company that was environmentally friendly. While the company employed energy-efficient innovations like solar panels, its infrastructure produced unacceptable power and cooling requirements. Find out how AISO leveraged AMD technology to overcome their challenge in this case study white paper.

In this whitepaper, Scalar explores the opportunity to change the landscape with respect to mission critical databases built around Oracle. Leveraging technologies such as Linux, high-end commodity processing power and Oracle RAC technology to architect, design, build and maintain database infrastructure that delivers maximum availability, reliability and performance at a fraction of traditional cost.

On a typical day, weather.com, the Web site for The Weather Channel in Atlanta, serves up between 15 million and 20 million page views. But in September 2004, when back-to-back hurricanes ransacked Florida, the peak traffic on one day more than tripled: over 70 million page views by more than 7 million unique visitors. Read the full success story now.

Marketplace