Best (free?) Sandbox?

[brahman]

Hi everybody,

I have used the portable Sandboxie now for a number of years and have been thinking to generally Sandbox my surfing and buy the full version (any discounts known?).

Before I do that, I wanted to ask my knowledgeable compatriotes at DC, if there may be another Sandbox which is just as good or better than Sandboxie, and may even be free.

Here is f.e. a list of them: http://malwaretips.com/Thread-Best-Free-Sandbox-Virtualization-Software

I use Sandboxie for the following purposes:
Surfing
Trying out programs
Analyzing programs (where do they write files, how deep do they manipulate my system, exporting their registry entries - so that I can install them manually without bloat if I desire to keep them - I use Sandboxie Diff and/or Total Commander for most of that process).

What are your comments/recommendations?

[majoMO]

  ~ Freeware ~

Surfing:
- For surfing 'SecuBrowser' is an option [works with IE and Firefox only]. It is not so strong like SandboxIE, but does the work; I installed it in some friends PC's that had problems with some Ransomware and it handle with them well. I moved their sandboxed folder to a RamDisk with a junction in original folder, between others changes in default instalation.

Trying out programs:
-  Applications that don't need to reboot - 'Toolwiz Time Freeze' is an excellent choice.
-  Applications that need to reboot - 'Toolwiz Time Machine' is a very good way; it is stable and in a non-beta state now. It has also a Time Freeze feature.

Analyzing programs:
- Using 'System Explorer'; their snapshot feature is useful and does the work.

Anyway: If you buy SandboxIE you are doing a very good choice and purchase/acquisition indeed!

[mouser]

My inclination is to always prefer using a full virtual machine software for testing things (VmWare, VirtualBox, VirtualPC, etc.).

[brahman]

Thanks majoMO for your suggestions. Secubrowser seems interesting.

@mouser: I think VMs are invaluable for incompatible programs. For other purposes, I find Sandboxie-like software easier to handle and faster.

[Vurbal]

Probably not very useful for your purposes, but Qemu and Damn Small Linux makes a brilliant portable sandbox. Really it's more of an underground bunker than a sandbox and it takes portable software to a completely different level.

That's actually what I was looking for. I wanted a reasonably secure way to run a full blown GPG installation from my thumb drive. I haven't had time to get that far yet but there's no question it will work just fine. Good thing too since the tools for Windows GPG are a kludgy mess.

Once I'm done with that I think the next step will be a Qemu Android VM for testing apps. I could even put Google OTP on it since I don't plan to have a mobile phone again until I find a carrier who won't try to bend me over on the price.

[40hz]

My inclination is to always prefer using a full virtual machine software for testing things (VmWare, VirtualBox, VirtualPC, etc.).

I'd +1 with Mouser on that.

Sandboxes are a little bit more like a hack or "science fair" sort of solution whereas a virtual machine is the real deal if you want to create an fully isolated system to work with. VMs are also better supported and generally more reliable from a security standpoint.

If your PC has the horsepower (most machines built in the last few years do) I'd definitely try running a VM.

When I need to do 'secure' web browsing I'll use Tails.

Tails is a live system that aims at preserving your privacy and anonymity. It helps you to use the Internet anonymously almost anywhere you go and on any computer but leave no trace using unless you ask it explicitly.

It is a complete operating-system designed to be used from a DVD or a USB stick independently of the computer's original operating system. It is Free Software and based on Debian GNU/Linux.

Tails comes with several built-in applications pre-configured with security in mind: web browser, instant messaging client, email client, office suite, image and sound editor, etc.

If you're not uncomfortable using a distro developed by the US government that does some of the same things as as Tails, there's also the Lightweight Portable Security distro which is available for download here.

[brahman]

Yes, it is clear from the replies that one can have more security when giving up comfort and when one has more horse power.

But I don't want to do either!

I have a relatively old ThinkPad with  a dual core T4500 @2,3GHZ and 4GB Ram 32bit Win7 system. It serves me fine and I have no plans to upgrade in the near future. Ironically I also have several Android devices, and my main ones all have quad cores . More and more I work with Android and that's also why I am not really willing to invest too much into the Intel platform and have to think hard to even buy Sandboxie, since prices for Windows software are 10 times+ what they are for Android.

And I also like comfort and don't want to do this reboot thing all the time or have a system bogged down by VMs, drumming my fingertips until it starts and finally runs. My system has just enough speed for me as it is, less just will not work (you must know my notebook is a 14in. because I travel a lot I have weight restrictions).

It is also harder for me to analyze software in VMs, it is easier to do in a sandbox.

[Tinman57]

  If I need to run something in a sandbox, I just use Comodo Firewall (free).  It has an option to do that....

[Renegade]

Again, +1 for mouser there.

VMs are the way to go. I keep a bunch of VMs handy at all times.

[brahman]

Thanks for all your comments.

[MilesAhead]

-  Applications that don't need to reboot - 'Toolwiz Time Freeze' is an excellent choice.

I'm just trying this out now.  For what it's worth, it seems to run as advertised on my Windows 8 x64 Laptop.  I just tried a simple test.  Download a file to desktop, then reboot.  File was gone after logon.  Seems nice and simple.

Only thing with these Returnil type utilities I absently tweak things, then remember changes are discarded.  Supposedly if you quit the app from the tray the changes are kept though.

[cyberdiva]

Only thing with these Returnil type utilities I absently tweak things, then remember changes are discarded.  Supposedly if you quit the app from the tray the changes are kept though.

Lately I've been using Shadow Defender.  It's not free, but it's moderately flexible and easy to use.  You can set aside certain files or folders that you don't want sandboxed, and you can also decide on the fly that the changes you've made to a particular file or folder should be saved rather than discarded when you leave "shadow mode" (the sandbox).  I've used it when making changes that I'm nervous about, or installing iffy Windows Updates, etc. etc.  So far, it's done its job well (knock on wood).

[MilesAhead]

I remember reading about SD awhile back.  I don't remember if I tried it though.  The technical write-up was impressive.  On the Laptop one "hazard" I'm running into is if I forget and do a fake shutdown (sleep) then next time it comes up the program comes up enabled instead of requiring me to start it.  I can either reboot or hold down shift during shutdown to get it to act as expected.

This slows down the boot up a bit.  Can't have everything I guess.  So far I haven't found any complaints about Time Freeze.  I'll run it a bit longer.  I don't like to use av "shield" software as it doesn't seem as smooth as just using the shadow mechanism.

When I had 2 desktop PCs I figured I could use the working machine to fix the broken one if one got hosed.  Now with just the Lappy I should be a bit more cautious. 

[IainB]

@MilesAhead: Where you say:

"... when next time it comes up the program comes up enabled instead of requiring me to start it."

Could you be more precise please? Which program are you describing?
I am very interested in how you are getting along with ToolWiz Time Freeze. Depending on your experience, I may trial it myself.

[MilesAhead]

@MilesAhead: Where you say:

"... when next time it comes up the program comes up enabled instead of requiring me to start it."

Could you be more precise please? Which program are you describing?
I am very interested in how you are getting along with ToolWiz Time Freeze. Depending on your experience, I may trial it myself.

I'm talking ToolWiz Time Freeze.  So far I like it.  One thing though, MBAM scans are slower with it enabled.  How I'm running it so far is to come up disabled in the tray.  I start it, then connect to WiFi etc..
If I want to do a scan or make an image backup I reboot.  It comes up disabled again.  Now I can do scans or whatever.  I have another partition for data.  I can just download to that without setting any exemptions.  It only protects the system partition.  When shutting down the Laptop I hold down shift to avoid sleep mode.  That way when I bring it up next time Time Freeze is in tray disabled again.  The boots aren't as fast as coming out of sleep.  But using Time Freeze is pretty much a no brainer.  I just accepted the defaults.

As I get used to it I will probably run fewer scans.  I guess I should run MBAM scans on the unprotected partition as well as the occasional quick scan.  So far when I've rebooted out of Time Freeze and done a scan with MBAM and SuperAntiSpyware everything has been clean.

Edit: The main confusion in using it so far for me is the shutdown.  If the program is active I need to hold shift on shutdown. If it is inactive in the tray I need to just click shutdown which is a form of sleep.  Like just awhile ago out of habit I shutdown holding shift.  When it came up my tray icons were all hidden.  I had to reset all the settings.  But as time goes on I should remember.  

Edit2: As I was getting accustomed to using Time Freeze it did come up active one time.  Clicking in the tray icon to turn it off was a pretty slow reboot.  That's one of the main reasons I have it start disabled.  But others may just choose to have it come up running.

[IainB]

^^ Thanks for the explanation + info. Very interesting.

[MilesAhead]

^^ Thanks for the explanation + info. Very interesting.

Sure thing.  Maybe this will work better on a desktop.  But lately no matter how careful I am about shutting down, it seems to hose my Tray Icon settings and lose the toolbar.  Also now and then I notice a lag, then "unresponsive plugin" in Pale Moon.  It would be nice if it worked effortlessly.  But the added boot times and other side effects make it a distraction.  For now I'm disabling it.

[IainB]

^^ Thanks for that further info.
Your previous comment decided me to wait and see if you came up with anything new. Your latest comment decided me that there was probably not much point in my repeating your experience on my laptop systems, so I shall not trial ToolWiz Time Freeze.

[MilesAhead]

Speak of the devil.  An update was released March 7:
http://www.toolwiz.com/time-freeze-change-log/


Edit:  I gave it a quick try.  I didn't notice anything different.  It's okay to have for free I suppose if I ever get a crazy impulse to surf in shark infested waters.