Let’s go through some sandbox applications
you could use to protect your applications
that interact with untrusted sources, such as the internet.
Particularly, you want to sandbox your browser
and email client as a minimum.
So Windows sandboxes first.
Have a look at this video on Bufferzone. It’s a commercial sandbox,
but the video will give you a good idea
of the sort of functionality that sandboxes offer.
Welcome to Bufferzone.
In this demo, we’ll show you how Bufferzone virtual container technology
blocks ransomware and other exploits,
prevents them from accessing your files,
and keeps them from infecting other users in your organization.
We received this ransomware inside an email attachment.
It’s embedded in a word file that looks harmless.
When you open the file,
the malware silently downloads onto the computer.
By the time you realize that the file isn’t legitimate and close it,
it’s too late.
At this point, the malware keeps quiet,
so a lot of users would decide that the file was just spam,
but in fact, the ransomware is busy working in the background
locking our files.
10 minutes later,
the ransom note arrives threatening to destroy
the encryption keys if we don’t follow their instructions.
When we click on show files,
we see a list of all the files on the disk that were supposedly encrypted.
No worries. We are protecting email attachments with Bufferzone.
The infected word file was opened in an invisible virtual container.
When Word is running inside the container,
it is actually segregated from the file system,
the registry, and the computer’s memory.
When the ransomware tried to access our files,
they were copied into the container.
The ransomware has encrypted the copy,
but our original files are safe.
If the exploit tried to write to the registry or memory,
it would also be fooled into accessing the virtual copy.
The Bufferzone container is also segregated from the network,
so the ransomware cannot get out to infect other computers.
To eliminate the ransomware,
we simply empty the Bufferzone container.
You see that the encrypted files are gone,
but the original files remain.
Bufferzone’s patented containment technology
provides protection from phishing scams, drive-by downloads,
malvertising, zero-day exploits, and many other types of advanced malware.
It enables you to browse the internet, open email attachments,
and open files from removable media safely.
Try Bufferzone today. Learn more –
So there you are. This product looks good,
but I haven’t comprehensively tested it.
It looks like they’re aiming at the business market though
and not for personal use,
but it looks like a very good product for Windows only.
Another sandbox type of technology is Shadow Defender.
Shadow Defender can run your system in a virtual environment
which they call the shadow mode.
Shadow mode redirects each system change to a virtual environment
with no changes to the real environment.
Not tested this one. This is Windows only.
Another sandbox-like tool that works slightly different is Deep Freeze.
And Deep Freeze is a kernel level driver
that protects the hard drive integrity
by redirecting information being written to the hard drive partition,
leaving the original data intact.
This redirected information is no longer referenced
once the computer is restarted,
thus restoring the system to its original state at the disc sector level.
So essentially what this is doing
is making sure that every time your system reboots,
it restores to exactly the same state.
This works on Windows, Mac, and Linux versions are available.
But know, with this type of sandboxing,
there’s no protection until you reboot.
So an attacker, for example, could read your files with malware
until you actually do the reboot,
and then when you do the reboot, the malware will no longer exist.
There is also the Deep Freeze cloud browser and desktop.
Another kind of sandbox is Returnil.
This creates a cloned version of your system partition
to boot from and then work within.
If anything does go wrong during your session,
you reboot the system and the operating system environment
is returned back to where it was
before you turned Returnil protection on.
But note that there is no protection until you do that reboot,
so an attacker could be reading your files with malware
or keylogging until you actually do that reboot.
But once you do the reboot, your system is returned to normal
and any malware or hacker will be removed.
And this is what it looks like.
It isn’t just a sandbox or virtual environment;
it also has additional features including files protection
and an anti-executable function.
It’s free for private use only.
The free Comodo firewall
comes with a built-in sandbox and virtual desktop.
The Comodo firewall is a good tool,
but Comodo lately has made some mistakes
with some of their security products,
so I don’t have a great deal of faith
in this sandbox and virtual desktop.
Some antivirus offer sandboxing functionality like Avast antivirus,
although I don’t recommend this as Avast are known to sell your data.
Bitdefender also has Safepay
which is a limited functionality browser providing sandboxing.