full-disclosure - Want to test this desktop barrier? (Unauthorized offer) 0day protection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1FA45C2E5F2E4B46967415DA3A804FE83C3A27@mail.greenborder.com>
Date: Fri Jun  9 02:05:43 2006
From: bill.stout at greenborder.com (Bill Stout)
Subject: Want to test this desktop barrier?
	(Unauthorized offer) 0day protection

 <<Re: [Full-disclosure] Want to test this desktop barrier? (Unauthorized offer) 0day protection>> Hi Thierry,

It is conceptually different than AV or AS products, which is which is why I fall back to analogies.  Even experienced security folk automatically categorize something new with existing products, and presuppose there is nothing new under the sun.

If you generally categorize anything that does virtualization as a sandbox, then it's a sandbox.  I mean, some people consider virtual machines a way to create a sandbox.  Wikipedia does.  Personally I think running VMware or Virtual PC just to run a browser securely is way too intrusive for the average user.  So to avoid the user experience of booting a virtual OS, why not create a virtual application instance that can't contaminate the computer?  I say that like it's easy, but it requires kernel knowledge to develop.  Otherwise you only virtualize a few directories and some registry entries, and are exposed to attacks which leverage system calls, COM objects, User Shell, etc..

I believe this list is read by some of the best and most aggressive hackers that exist, and this is the best place to expose a new security product.  I am interested in what the list has to say.  

Bill Stout

_____________________________________________ 
From: 	Thierry Zoller [mailto:Thierry@...ler.lu] 
Sent:	Thursday, June 08, 2006 3:04 PM
To:	Bill Stout
Cc:	full-disclosure@...ts.grok.org.uk
Subject:	Re: [Full-disclosure] Want to test this desktop barrier? (Unauthorized offer) 0day protection

Dear Bill Stout,

Your are posting to Full-disclosure, not your average mailinglist, you
don't need stories about toddlers and gloves, or "shots". ;)

>If you see a toddler?
>about to touch a dead animal, it's best they're wearing gloves rather?
>than being up to date on their shots.?

First it's a bad analogy, second it's plain wrong.

>?We refer to the virtual environment as?'x-space', or?'within?GreenBorder'. ?
let's stick to some standards should we ? S A N D B O X?

--?

http://secdev.zoller.lu

Thierry Zoller

Fingerprint : 5D84 BFDC CD36 A951 2C45 ?2E57 28B3 75DD 0AC6 F1C7

-------------- next part --------------
An embedded message was scrubbed...
From: "Thierry Zoller" <Thierry@...ler.lu>
Subject: Re: [Full-disclosure] Want to test this desktop barrier?
	(Unauthorized offer) 0day protection
Date: Thu, 8 Jun 2006 15:04:10 -0700
Size: 2040
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060608/6434dc35/attachment.mht