.

Browser protection (sandboxing) from Avast

<<

alucian

User avatar

Full Member
Full Member

Posts: 228

Joined: Mon Dec 29, 2008 2:01 pm

Location: Montreal, Canada

Post Wed Jul 18, 2012 1:37 pm

Browser protection (sandboxing) from Avast

Hi,

Is anyone using something like this? Is it really that good? Are there any drawbacks or vulnerabilities?

At a first look it is excellent. It suppose to protect you from many attack vectors.

Thanks!
CISSP ISSAP, CISM/A, GWAPT, GCIH, GREM, GMOB, OSWP
<<

SephStorm

User avatar

Hero Member
Hero Member

Posts: 569

Joined: Sat Apr 17, 2010 12:12 pm

Post Thu Jul 19, 2012 5:32 am

Re: Browser protection (sandboxing) from Avast

There was a Hak5 episode talking about sandboxing some time ago, they did a comparison. It came down to the susceptibility of the user, and the ability of the software to allow you to save downloaded files to your box. For instance, Comodo in the test did really well because it did not allow most of the files to be downloaded to disk. Most of the others allowed you to save it to the pc, where you could decide to run it in a sandbox or not. Most users are not going to do so with everything they download.

What interested me more so however, was a discussion on programs that would allow you to run suspicious files in a virtual environment, and report activity, such as opening ports, or downloading other files, ect, Unfortunately, it seems that these are all either online, or commercial. if anyone knows of a program that can be ran locally, with similar functionality, please let me know.
sectestanalysis.blogspot.com/‎
<<

alucian

User avatar

Full Member
Full Member

Posts: 228

Joined: Mon Dec 29, 2008 2:01 pm

Location: Montreal, Canada

Post Thu Jul 19, 2012 7:49 am

Re: Browser protection (sandboxing) from Avast

Thanks for the info.

Because we will use it in a business environment, the user should be allowed to download files, and even to save the bookmarks, cookies.. on the browser.

I saw that if you are clicking a pdf file, fir example, and choose the option to open it it will open in a sandboxed Adobe, which really is excellent.

Today and tomorrow I'll try some Java, Flash.. exploits and see what happens.
CISSP ISSAP, CISM/A, GWAPT, GCIH, GREM, GMOB, OSWP
<<

SephStorm

User avatar

Hero Member
Hero Member

Posts: 569

Joined: Sat Apr 17, 2010 12:12 pm

Post Thu Jul 19, 2012 11:13 am

Re: Browser protection (sandboxing) from Avast

I dont see it working unless you can force users to open certain extensions in a sandbox, maybe using applocker or something.
sectestanalysis.blogspot.com/‎
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Wed Jul 25, 2012 7:39 pm

Re: Browser protection (sandboxing) from Avast

I am not sure if Sandboxing would be great for the enduser.  I don't think you can centrally manage such software.  But if you did something like VDI or Xen Desktop for all the mission critical apps and keep the main desktops segmented from the production servers (with the exception of allowing only the VDI or Xen Desktop traffic through), then you will certainly add some hurdles for any would-be attacker.

I saw a product at RSA this past year that caught my attention, (BLP)-Cloud from DaoliCloud.  Think Inception but on the desktop.  It is basically VDI withing a single system.  Main host is a linux distro where the user can do just about anything internet wise.  Then it drops down a level to a VM that is locked down with a couple layers of security on it.  Might be more than you are looking for.

Essentially sandboxes are used more for malware analysis and other app testing to keep activity contained. 
Certs: GCWN
(@)Dewser
<<

alucian

User avatar

Full Member
Full Member

Posts: 228

Joined: Mon Dec 29, 2008 2:01 pm

Location: Montreal, Canada

Post Fri Jul 27, 2012 9:27 am

Re: Browser protection (sandboxing) from Avast

Interesting concept, but how can you apply it to a whole team?

Like any enterprise software you need support for it. Worse, these restrictions are demanded by a gov client, which is very paranoid about security. So ... having a Chinese software processing their data... not a very good idea :)

Actually, the demand is that every time an applet is loaded a prompt will appear, and the user should accept it. For example, going to Google main page would mean to click OK seven times. This should prevent some web appl attacks. The problem is that the users will not be able to browse anymore, and they need this option in order to do their job (for other clients).

I was thinking that a better browser protection will make the agency withdraw the request.

I tried Avast sandboxing at home and at work. At home it works just fine, but at work it doesn't work so well. I can browse to some sites, but not to others. I think that you cannot browse to a site with an invalid certificate. As an example our Nessus has the self-created, unsigned, certificate, so I wasn't able to go tp the Nessus web page.

Now, I don't know if I should ask the help of the Avast team (we aren't even their clients), or to try to find another solution to this problem.
CISSP ISSAP, CISM/A, GWAPT, GCIH, GREM, GMOB, OSWP
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Sun Jul 29, 2012 7:07 am

Re: Browser protection (sandboxing) from Avast

Ah yes, Chinese software is probably not the best solution :D  So what is the the goal the gov't is trying to obtain from you?  Sounds on to me they would enforce something that would pretty much make it impossible for people to get things done.  Is it just for select systems or for all?  Do they want clean systems accessing their app/site?  If so you can always do something like a vmware VDI solution that runs a heavily limited/filtered browser that can only connect to their app and nothing else.  Maybe even put them in a vLAN that is only allowed to go to that specific IP range on the net.
Certs: GCWN
(@)Dewser
<<

alucian

User avatar

Full Member
Full Member

Posts: 228

Joined: Mon Dec 29, 2008 2:01 pm

Location: Montreal, Canada

Post Mon Jul 30, 2012 10:17 am

Re: Browser protection (sandboxing) from Avast

Indeed the use of those restrictions would make the life of the users a real hell.
Practically you cannot browse the internet anymore.

Luckily, this policy affects a limited number of users.

Probably, using a VM for gov related tasks would be a good idea, but it is not so easy to sell it to management.

I'll see.

Thanks!
CISSP ISSAP, CISM/A, GWAPT, GCIH, GREM, GMOB, OSWP

Return to Other

Who is online

Users browsing this forum: No registered users and 3 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software