What is Sandbox?

In computer security, a "sandbox" is a security tool for isolating running programs, usually to lessen system failures or software vulnerabilities from spreading.

It is often used to execute untested or untrusted programs or code, possibly from untrusted third parties, suppliers, users or websites, without risking harm to the host machine or operating system.

The concept of Sandbox

Let the program to be executed in a virtual or simulated environment before being executed in the formal environment. 

Sandbox

Examples of sandbox implementations include the following:

• Google Sandboxed API
• A jail
• Virtual machines emulate a complete host computer
• Sandboxing on native hosts
• etc

The current anti-virus software will use sandboxing to ensure security.

Sandbox in Windows 10

It is a new feature in the major update of Windows 10 May 2019. But Windows 10 Home does not provide this feature.

Some properties that Windows Sandbox has :

• Pristine
• Disposable
• Secure

New page

New page

Each page is a sandbox.

New page

New page

malicious

Sandboxed API

The Sandboxed API automatically generates sandboxes for C/C++ libraries and produces reusable and secure functional implementations in popular software libraries to protect the remaining software infrastructure. 

Well-known malware not afraid of sandbox simulation analysis：

• RANSOM_LOCKY
  • encrypted DLLs
  • Windows script files
  • spam attachment files
• Disttrack
• OSX_KERANGER
• etc.

fileless attack

Here are a few fileless attack avoidance tips:

How to avoid?

Since the techniques for evading sandbox simulation are becoming increasingly popular among malware.

The sandbox environment must be customized to accurately reflect the system configuration in the real world. 

Reference - 2

• Python 沙盒逃逸备忘。Retrieved from: https://www.k0rz3n.com/2018/05/04/Python%20%E6%B2%99%E7%9B%92%E9%80%83%E9%80%B8%E5%A4%87%E5%BF%98/

• Windows Sandbox. Retrieved from: https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849
• 一文看懂Python沙箱逃逸。Retrieved from: https://www.jishuwen.com/d/2F7p/zh-tw