(HD) Sandboxie Vs. Rootkit (Avast_Home_Free in action)

Please leave a comment and rate the video :)

Running Windows XP SP2 in VirtualBox.

Sandboxie is such a great tool for general everyday use or for testing untrusted programs such as keygens or cracks, even for running your browser, which is probably the most vulnerable program you have running on your computer. It regularly has direct contact to the outside world when visiting websites, it runs executable code in client side scripts such as with JavaScript, making it exploitable by spyware and drive-by downloads. Poor programming or unforseen mistakes can also mean your browser can be exploited in different ways to that of JavaScript, running a browser sandboxed means any modifications made to your system through your broswer are actually made to dummy copies in the Sandbox, making for a neat and tidy recovery. I will post a video on drive-by downloads in action in the near future.

All credit to Avast, for identifying the threat, and many many others in the past. In this video I had realtime protection turned off, which filters all aspects of your internet connection, analysing all data being sent and received. It's probably the best Anti-virus you can get, even when comparing to the likes of Nod32 and its free.

Sandboxie: http://www.sandboxie.com

VirtualBox: http://www.virtualbox.org

Avast Home Free 4.8: http://www.avast.com/eng/avast_4_home.html


Unfortunately SandBoxie does not work on 64bit Vista or 64bit XP. The reason being because of preventative measures Microsoft introduced in a program called Patchguard. It routinely checksums your kernel to check for modification. It is also apparently not a hard program to get round, SandBoxie is. It's not only SandBoxie, but many other Security applications provided by the likes of Mcafee and Norton rely on Kernel modifications to work. Microsoft in the past have demonstrated how incapable they are at keeping your data safe. This is a clear demonstration of how real security works, Microsoft should take note of Tzuk's work, because they could learn a lot.

Category:

Science & Technology

Tags:

• sandboxie
• sandbox
• virtualbox
• virtual-machine
• avast
• anti-virus
• rootkit
• malware
• spyware
• trojan
• worm
• HD
• high-def
• high-definition

[quelorepario]

@NiGhtMarEs0nWax Semantics. An exploit is simply abusing bad programming, bad implementation or bad design. You don't need a specific exploit for Deep Freeze, if the user is running DF with an administrators account, you can install a Kernel Footnote bypassing the massive hooks.

[NiGhtMarEs0nWax]

@quelorepario that is true, but one would be exploiting stupidity or bad administration in that case; You would still need a more useful payload, such as shellcode, to install the rootkit, and a backdoor, to give it a purpose; A rootkit on its own is not enough to compromise a system. A kernel mode rootkit modifies kernel space only, once installed, and is of no use to bypass initial security measures.

[Remui]

Those who play with fire might get burned.

Do you know what kind of data that piece of malware sent out?

[NiGhtMarEs0nWax]

@Remui it was probably a bot client, but i didn't sniff it. it was running in a virtual machine anyway. feel free to enlighten me.

[quelorepario]

@NiGhtMarEs0nWax I know that DeepFreeze can be defeated with Kernel Rootkits, have you tried one in a sandboxie?

[NiGhtMarEs0nWax]

@quelorepario the one demonstrated in the video is a kernel mode rootkit; it uses a kernel module.( driver )

Rootkits on their own are useless, they posses no abilities to exploit or penetrate a system; That is the job for an exploit.

Exploits have circled in the wild for Sandboxie in the past, direct contact with such would leave your system compromised. Such a concept is not foreign to any software, including deep freeze.

Sandboxie software is obscure enough to be out of the limelight; mostly.

[majinpvegeta]

Nice demonstration of the best anti spyware/malware application on the net.

[quelorepario]

@Remui Fire is dangerous for the clueless. It doesn't apply for those experienced who play with fire with fireproof suits in controlled labs.

In the physical world they are called chemists and pyrotechnicians. In the digital world they are called hackers.

[NiGhtMarEs0nWax]

@nextone1985 mason - exceeder. :)

[nextone1985]

song?