full-disclosure - Re: why not a sandbox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4BBDC453.6060200@googlemail.com>
Date: Thu, 08 Apr 2010 13:56:03 +0200
From: Marius <wishinet@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: why not a sandbox

Am 05.09.09 04:28, schrieb Fatherlaptop:
> ok. that's cool. not sure about enterprise compatibility or my English  
> but will check it out. my other option is front end. Lately, we have  
> ha "lots" of drive by infections. I have though "trained" users and  
> get calls on the "fake alert" box.
> 
> It's a 3GS iPhone Thang!
> 
> On Sep 4, 2009, at 3:12 PM, Kurth Bemis <kurth.bemis@...il.com> wrote:
> 
>> Check out:
>>
>> http://www.sandboxie.com/
>> http://www.xenocode.com/Browsers/
>>
>> ~k
>>
>> On Fri, 2009-09-04 at 13:05 -0500, RandallM wrote:
>>> how come we just can't sandbox the browser in away from the system.
>>> its the users that just get gmail and click links, watch youtube vids
>>> and check FaceBook and Mypace that infect the network!
>>>

Actually Chrome for example comes with a sandbox security model.
Nevertheless it's the same old situation: root is chroot is still root.
Data-loss in a sandbox is still data-loss.

-- 
Marius
crazylazy.info


Download attachment "signature.asc" of type "application/pgp-signature" (858 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/