Attacking Sandboxes

SkiifGeek writes "Many anti-malware applications use a sandbox as a tool to help identify potentially malicious software. Now knowledge is spreading about techniques and methods that can allow sandboxed software to target the sandbox itself (and by extension the application that applied it). While attacks that specifically target sandboxing applications are probably a little way off, this technology can be considered the logical extension of techniques and procedures to identify the presence of hosted systems (VMWare, Virtual PC, etc.)."

Sandbox the sandbox

[robo_mojo (997193)]

That's ok. We can just sandbox the sandbox and still be safe.

Re:Sandbox the sandbox

[langelgjm (860756)]

But who will sandbox the sandboxers?

Re:Sandbox the sandbox

[ehrichweiss (706417)]

HA! I got you on that one!!! It's sandboxes all the way down!!!!!

Love this -- like the turtles....

[CFD339 (795926)]

Just remember....recursive code is great code, because its recursive, so its great.

Re:Love this -- like the turtles....

[ettlz (639203)]

Just remember....recursive code is great code, because its recursive, so its great.

Well I'd just like to point out thaStack overflow
Aborted

Re:Sandbox the sandbox

[GizmoToy (450886)]

You know, this was marked as Funny but I wouldn't be surprised if this was suggested as a solution at some point. "Hell, just wrap it in another (insecure) layer and it'll be fine."

Re:Sandbox the sandbox

[CastrTroy (595695)]

Sounds like the security methods most online banking systems use. Here's the current layers:

• password
• mother's maiden name/ what's you're favourite movie
• secret picture
• randomized keypad for entiring password

It's all layers of useless crap piled on top of eachother which doesn't stop the real problem of people falling for stupid fishing sites, and entering a password in a site that looks like their bank's. If they really wanted to add real security they'd hand out RSA key fobs to everyone instead of adding layers of stuff that makes it look more secure but actually isn't.

Re:

[billcopc (196330)]

So you're saying the RSA key fob isn't another useless insecure layer of crap ? Have you even HEARD their sales pitch ?

Re:Sandbox the sandbox

[Poltras (680608)]

as long as USERS don't understand it, yes it is useless. Secure the communication and provide X509 certs all you want, if the user think it's a bank, he will enter his password.

Re:

[mcrbids (148650)]

as long as USERS don't understand it, yes it is useless. Secure the communication and provide X509 certs all you want, if the user think it's a bank, he will enter his password.

I don't think you understand what he's really saying - you could hand out RSA key fobs and/or client certificates that authenticate the browser to the bank. Without that, the password would/could be utterly useless.

If the bank uses the key fob, you can't enter by password alone. If the bank uses client certificates, then that must be

Re:

[arminw (717974)]

..... If they really wanted to add real security they'd hand out RSA key fobs to everyone......

Does that mean the use is restricted to the users own computers or any others that has the correct interface and software which is able to send the key-fob data to the bank's server at the correct time?

A password will work with *any* computer, but a piece of hardware, whether key-fob or biometric scanner will only work with a computer that has the correct software installed on it. That software would have to be st

Re:

[Miseph (979059)]

Because the AV/S/M app is frequently able to obtain all sorts of wacky permissions and access, it could be viable to piggyback on it into otherwise secure systems. For example, if an AV was set up such that it could scan encrypted data, then exploiting it to get past the encryption could be feasible.

Serves us right

[jimbug (1119529)]

for building a box out of sand. what were we thinking?

Re:

[RAMMS+EIN (578166)]

I thought sand was central to most boxen.

Well, silicium, anyway.

Old news

[Nick_taken (1090721)]

Theres a simple detection program called RedPill that probes a simple method to do so, vmware leaves a lot of registry keys on windows, VirtualBox lacks supports for hardware breakpoints, cpu cycles counts is another way to detect virtualization, and some packed malware dont even run on virtual machines because of memory management, software packed with armadillo do not run on vbox and it used to fail on vmware player until they fixed that bug.

"Thwarting Virtual Machine Detection" is a nice paper on virtual machine detection.

Re:

[QuantumG (50515)]

It's pretty trivial to find a dozen ways to detect a virtual machine, just make a project that generates some random bytes and then jump to the bytes. Put the program in a script that calls it over and over again with a seed for the random number generator. When the VM crashes, look at the last seed that was used. Run the program again with that seed to confirm it is repeatable. This also happens to be a good way to detect if your VM is any good and fix it when it isn't. Unfortunately, many things are

Strike vs Counterstrike

[mcrbids (148650)]

There will never, ever be an end to this.

As long as people are imperfect (and they always will be) there will be measures, countermeasures, and counter-counter measures. New techniques will make old ones obsolete, and even newer techniques will make the once-new techniques no longer apply.

With this understanding, any technology that can outsurvive more than one or two iterations of other products in the same field becomes "venerable" and "stable".

Which makes now a particularly good time to appreciate the guys who worked out the spec for TCP/IP some 30 (?) years ago. Despite going from mainframes, to minis, to PCs, and now on to the era of ubiquitous computing, the basic concepts and ideas behind the TCP/IP specification continue to hold steady and useful. They managed to come up with a technology, that whatever flaws have actually been found, hasn't come up against any real show-stoppers. None.

To which I can only say: WOW.

Re:Strike vs Counterstrike

[mcrbids (148650)]

TCP hijacking is almost just as easy now as it was 10 years ago.

It may be even easier. Who cares? However you look at it, TCP is doing its job. If you want to prevent against hijacking, the layered topology of the communication stack lets you prevent that at a higher level. (EG: Using encryption - which can be interrupted, but not hijacked)

TCP hijacking is merely a side effect of a missing layer in the stack of your application.

Re:

[QuantumG (50515)]

It's not about being able to sniff packets. That just makes it more applicable because, back then, you didn't need to be upstream. Today, if you're upstream of an end point you can hijack a TCP connection.

Once again, they didn't read the article.

[Cafe Alpha (891670)]

The article didn't say that they've found code that attacks sandboxes, it said that they've found code that detects a sandbox (VMWare for instance) and plays innocent so as to avoid detection through the sandbox.

It also said that software has been found that detects when it's attached to a debugger. Big deal, copy protection schemes have been doing that for decades.

The article then goes on to FUD that code that attacks the sand box "must" be coming.

Oh, it must be coming. Uhuh.

Umm... yes? And?

[Opportunist (166417)]

That malware detects VMs is old news. I'd wager about 60% of current malware has VM detection built in. About as many have debugger detection. Some overlapping allowed.

So far, malware that "breaks out" of the sandbox would be new to me (though I'd be grateful for a sample). Though, seriously, why not run a VM with Windows (to analyze) on a box running Linux? I'd be very interested if someone manages to do the feat of creating a piece of malware that manages to break out of the sandbox and then run on a machine with a completely different operating system.

If you wanna throw another stick between the malware's feet, run the VM on a non-i386 architecture. If someone manages to break out of THAT and manages to hijack my machine, he really earned it and should get it.

Detecting virtualization?

[macemoneta (154740)]

Being able to detect virtualization would be great, if the technique can be generically applied [wikipedia.org].

There is no spoon [wikipedia.org]

Re:Watch what I can do

[click2005 (921437)]

I've got friends who know how to block your friend's actions.

Re:Arms race for nothing

[dbIII (701233)]

Meanwhile, I avoid ALL forms of anti-malware tools, and magically I rarely get infected. When I do

Isn't once enough for anyone? You did format and restore from a known good backup or install media afterwards didn't you? There's a tendency lately to trust that whoever had full control of your PC did nothing but run a set script and blindly hope that there is nothing else on there. I've played with various removal tools when people have given me compromised machines and different tools gave me different answers the other tools could not detect - perhaps there were some things neither could detect, hard to be sure especially when you are booting from a compromised system.

Fdisk it from orbit - it's the only way to be sure.

Re:Arms race for nothing

[bmo (77928)]

"Fdisk it from orbit - it's the only way to be sure."

Even Microsoft agrees with you. You can't "clean" a compromized machine.

http://www.microsoft.com/technet/community/columns /secmgmt/sm0504.mspx [microsoft.com]

That goes for other OSes too.

--
BMO