A sandbox is a security mechanism for containing and restricting untrusted programs. Such programs could contain malicious code, which would otherwise harm the user's system.
Questions tagged [sandbox]
195 questions
13
votes
1 answer
How do HTML5 DRM addons protect their output?
HTML5 has a DRM framework Encrypted Media Extensions (EME), that allows DRM companies to create content decryption modules (CDM) to decrypt DRM protected content. Browsers should use a sandbox to run the CDM, so that security holes that allow access…
![](../../users/profiles/110686.webp)
allo
- 3,173
- 11
- 24
13
votes
2 answers
Malware sandbox detection
I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from the awesome github repository called The Zoo.
I…
![](../../users/profiles/133285.webp)
OscarAkaElvis
- 5,185
- 3
- 17
- 48
13
votes
1 answer
How is a public scriptable site like codepad or ideone manages it's sandboxing?
I've researched this stuff a lot in the recent months but I can't grasp any solid basis on how they achieve running unsafe scripts in so many languages without a problem!
I'm sure they are running virtual machines since language specific sandboxes…
![](../../users/profiles/8224.webp)
alfa64
- 231
- 1
- 4
12
votes
3 answers
What is sandboxing?
In security discussions, the topic of sandboxing often comes up. What is application sandboxing? How does it work, and what security vulnerabilities does it prevent?
![](../../users/profiles/793.webp)
jrdioko
- 13,011
- 7
- 29
- 38
12
votes
1 answer
How secure is Sandboxie?
Sandboxie is a very popular and useful program for handling suspicious executables on Windows. Due to flawed security properties of Windows systems (eg. compared to Linuxes), it is hard to rely on the OS alone for containing threats, yet a full…
![](../../users/profiles/9687.webp)
Superbest
- 1,094
- 8
- 20
12
votes
1 answer
Microsoft Word protected view - is it secure enough to protect users?
We had a user receive an email with what appears to be a Word Doc virus and it wanted them to open the file and enable editing. If they did not enable editing but merely opened the file, should we be concerned that they may have gotten a virus…
![](../../users/profiles/79415.webp)
sa289
- 317
- 3
- 11
11
votes
2 answers
Does Android have sufficient app sandboxing?
In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions.
Now I would like to ask a related, but different question: Is it important to check the safety of an Android app…
![](../../users/profiles/59811.webp)
RockPaperLz- Mask it or Casket
- 3,114
- 21
- 50
11
votes
2 answers
Running proprietary software on Linux safely
As a summer project, I'm looking to prevent any piece of proprietary software like many games I run from have access to my personal files. After looking a lot at sandboxing, I've decided that anything like chroot is far too complicated for me to…
wearilywandering
11
votes
3 answers
How to securely run Puppeteer / Chromium in a Docker container?
Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.
The problem is that, from my understanding, to run as root, you need the…
![](../../users/profiles/211395.webp)
Torque
- 211
- 2
- 4
11
votes
4 answers
How to avoid leaving any local trace that I went to a website?
I want to visit a web site, but I want to ensure there is no trace left on my computer that I did so. How do I do that?
This question is not concerned with anonymity or detection on the network side, but on the local side. I am familiar with the…
![](../../users/profiles/36538.webp)
Eric G
- 9,691
- 4
- 31
- 58
11
votes
2 answers
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment and return the result, embedding the output of…
![](../../users/profiles/8654.webp)
Phani
- 223
- 1
- 6
10
votes
2 answers
Why does Android use SELinux?
To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them too. What does SELinux provide or what do the…
![](../../users/profiles/6937.webp)
user220201
- 893
- 9
- 22
9
votes
2 answers
What are the potential security problems running untrusted code in a Docker container as a non-root user?
I've seen plenty of ink spilled by now about how Docker is not sufficiently isolated to allow arbitrary containers to be run in a multi-tenant environment, and that makes sense. "If it's root in Docker, consider it root in the host machine." What…
![](../../users/profiles/84477.webp)
Michael Bleigh
- 191
- 2
9
votes
4 answers
What to do about companies that refuse to fix their security vulnerabilities
While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform unauthorized privilege escalation through a…
![](../../users/profiles/16778.webp)
bbosak
- 191
- 1
8
votes
2 answers
Can an unprivileged process in a hardware-virtualized system cause a `VMExit` without cooperation from the kernel?
For SVM or VT-x, the set of conditions which trigger a vmexit to the virtual machine monitor is pretty complex. Can an unprivileged process trigger any of these without assistance from the kernel? The documentation for VMMCALL and VMCALL both say…
![](../../users/profiles/6421.webp)
Harry Collins
- 165
- 2
- 6