henryg_1 Posted December 30, 2013 ID:770693 Share Posted December 30, 2013 You say that "Sandboxie may prevent MBAE from injecting its DLL into protected processes" and indeed MBAE fails to recognise eg Firefox running in a Sandbox. Is there a workaround? I will also enquire at Sandboxie. Henry Link to post Share on other sites More sharing options...
Durew Posted December 30, 2013 ID:770695 Share Posted December 30, 2013 As far as I am aware there is no workaround yet. I've tried the 'injectdll' function of sandboxie but I haven't been able to get it working yet.If you do find a work around. Please post it here, I believe there are quite some people who would like to know around here. (Me for starters.) Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:770874 Share Posted December 31, 2013 Yes, please post at Sandboxie. The more users request Sandboxie to allow MBAE the more likely the creator of Sandboxie will look into this. Thanks! Link to post Share on other sites More sharing options...
Conan Posted December 31, 2013 ID:770876 Share Posted December 31, 2013 Hello, there is already a a fix with this. You must configure your shortcut for the sandboxed browser to be launched by explorer.exe. If you are using Pro version of Sandboxie, just use the forced program feature. Another method is to run explorer.exe sandboxed, search for your browser and run it there. Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:770877 Share Posted December 31, 2013 Interesting, thanks Conan!! I will post your workaround in the MBAE Known Issues & Conflicts list. Link to post Share on other sites More sharing options...
Conan Posted December 31, 2013 ID:770940 Share Posted December 31, 2013 Interesting, thanks Conan!! I will post your workaround in the MBAE Known Issues & Conflicts list.Hello, after reading in the Sandboxie forums, what I posted is for EMET to work with Sandboxie. I haven't tested if it also would work with MBAE (I think it would still work with what I mentioned but a template, I think is needed to be added in Sandboxie). Sorry for the confusion (since I have been using EMET and MBAE and removed Sandboxie) Link to post Share on other sites More sharing options...
Conan Posted December 31, 2013 ID:770942 Share Posted December 31, 2013 -http://www.sandboxie.com/phpbb/viewtopic.php?t=15965 this is the post I am talking about, sorry for going off-topic. Maybe users of both MBAE and Sandboxie could send an email to Invincea (new owners of Sandboxie to fix the issue.) Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:770975 Share Posted December 31, 2013 Can someone please test this and confirm if the workaround is valid? Link to post Share on other sites More sharing options...
Durew Posted December 31, 2013 ID:771004 Share Posted December 31, 2013 I've given it a try, so far no luck. I opened "my computer" sandboxed, thus opening a windows explorer window (taskmanager confirms the process behind it is explorer.exe). Than I opened the exploit-test which came with MBAE, it worked flawlessly (the exploit) thus the calculater opened. Than I ran firefox from the same sandboxed windows explorer window. MBAE doesn't show a thing. ProcessExplorer does not indicate any injected dll's. If this wasn't the procedure meant, please correct me so I can try again. Link to post Share on other sites More sharing options...
henryg_1 Posted December 31, 2013 Author ID:771014 Share Posted December 31, 2013 Can someone please test this and confirm if the workaround is valid? It doesn't work on my Win7 64bit system Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:771026 Share Posted December 31, 2013 OK I've edited out the workaround from the Known Issues and Conflicts list while you (and us) do some more thorough testing with this. In the meantime, happy new year! Link to post Share on other sites More sharing options...
1PW Posted December 31, 2013 ID:771051 Share Posted December 31, 2013 I know this runs counter to the experiences of some other users. My W7 Pro 64-bit SP1 OEM Up to date system is currently running: MBAE 0.09.5.0250 PreviewEMET 4.1 w/Deep Hooks and Maximum security settingsSandboxie 4.07.05 (64-bit) beta Paid/Registered I do not have any known workarounds in place. From the attached JPEG, you can see, in the background, MBAE+EMET+SBIE. I am experiencing continuous trouble launching the new TOR-Browser-Bundle 3.5 in a sandbox. [Reported to SBIE] and MBAE blocks Opera 12.16 with certain web sites. [Reported to Pedro] But that's it... YMMV Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:771057 Share Posted December 31, 2013 Can you please check if mbae-test.exe is blocked correctly under this setup? Link to post Share on other sites More sharing options...
henryg_1 Posted December 31, 2013 Author ID:771065 Share Posted December 31, 2013 I know this runs counter to the experiences of some other users. My W7 Pro 64-bit SP1 OEM Up to date system is currently running: MBAE 0.09.5.0250 PreviewEMET 4.1 w/Deep Hooks and Maximum security settingsSandboxie 4.07.05 (64-bit) beta Paid/Registered I do not have any known workarounds in place. From the attached JPEG, you can see, in the background, MBAE+EMET+SBIE.Forgive me, but are the browsers definitely being sandboxed when MBAE shows them to be protected? You don't show the Sandboxie Control window. Link to post Share on other sites More sharing options...
1PW Posted December 31, 2013 ID:771078 Share Posted December 31, 2013 Forgive me, but are the browsers definitely being sandboxed when MBAE shows them to be protected? You don't show the Sandboxie Control window. Hello henryg_1: Not to worry. HTH Link to post Share on other sites More sharing options...
Staff pbust Posted December 31, 2013 Staff ID:771217 Share Posted December 31, 2013 Wow, you still read alt.comp.anti-virus? You must be one of the oldies Btw does MBAE throw an alert when you run the mbae-test.exe utility under this config with Sandboxie? Link to post Share on other sites More sharing options...
1PW Posted January 3, 2014 ID:773004 Share Posted January 3, 2014 After further review... Embarrassingly I must fully retract my results in post #15 above in this thread as it is a misrepresentation of the true facts. I failed to double-check my work before I posted. I truly apologize to all that have been mislead. Indeed it appears that Sandboxie 4.07.05 blocks the injection of mbae.dll in my browsers. The true and more complete picture of my results are attached below. henryg_1: I support your original post and I apologize for my misleading answer to your question above. Pedro: The mbae-test operates thusly: Normal = Launches the Calculator while Exploit = Exploit Blocked message. Yes - I still lurk Usenet as gems of wisdom still surface from time to time. My first email account was opened in 1987. Link to post Share on other sites More sharing options...
Durew Posted January 4, 2014 ID:773207 Share Posted January 4, 2014 Did you run the mbea-test sandboxed?(I don't expect so but I'd like to be sure.) If you did, then there is still hope! Link to post Share on other sites More sharing options...
henryg_1 Posted January 4, 2014 Author ID:773270 Share Posted January 4, 2014 After further review... Embarrassingly I must fully retract my results in post #15 above in this thread as it is a misrepresentation of the true facts. I failed to double-check my work before I posted. I truly apologize to all that have been mislead. Indeed it appears that Sandboxie 4.07.05 blocks the injection of mbae.dll in my browsers. The true and more complete picture of my results are attached below. henryg_1: I support your original post and I apologize for my misleading answer to your question above. Certainly no apology needed. Kaspersy now seems to be working again with HitmanPro.Alert, and as the latter works with Sandboxie, for my purpose it is the better solution. Henry Link to post Share on other sites More sharing options...
1PW Posted January 4, 2014 ID:773305 Share Posted January 4, 2014 Did you run the mbea-test sandboxed?(I don't expect so but I'd like to be sure.) If you did, then there is still hope! Hello Durew: Yes. I ran the mbae-test.exe while I had Firefox 26.0 within a v4.07.05 64-bit beta sandbox and the exploit test produced what is captured in the attached JPEG. Does this answer your question? Link to post Share on other sites More sharing options...
1PW Posted January 4, 2014 ID:773316 Share Posted January 4, 2014 Certainly no apology needed. Kaspersy now seems to be working again with HitmanPro.Alert, and as the latter works with Sandboxie, for my purpose it is the better solution. Henry Hello Henry: Congratulations on your successful experience. IMHO, MBAE is maturing quite nicely to the extent that soon users can re-examine their use of EMET & hmp.alert Link to post Share on other sites More sharing options...
Durew Posted January 12, 2014 ID:776958 Share Posted January 12, 2014 Hello Durew: Yes. I ran the mbae-test.exe while I had Firefox 26.0 within a v4.07.05 64-bit beta sandbox and the exploit test produced what is captured in the attached JPEG. Does this answer your question? It does, thanks for the reply. The picture you included confiremd my "worst fear". I hoped you ran mbae-test.exe by left-clicking->'run sandboxed', but the picture and your description indicate that you ran the test outside the sandbox (while another program, firefox, was sandboxed). On my machine mbae-test.exe gives a, sandboxed, calculator whenever I try use mbae-test.exe in one of my sandboxes/under the supervision of sandboxie (see picture). I hoped you got a different result. Ah, well. Let's go find invincea's costumer support for sandboxie. Link to post Share on other sites More sharing options...
1PW Posted January 12, 2014 ID:777069 Share Posted January 12, 2014 It does, thanks for the reply. The picture you included confiremd my "worst fear". I hoped you ran mbae-test.exe by left-clicking->'run sandboxed', but the picture and your description indicate that you ran the test outside the sandbox (while another program, firefox, was sandboxed). On my machine mbae-test.exe gives a, sandboxed, calculator whenever I try use mbae-test.exe in one of my sandboxes/under the supervision of sandboxie (see picture). I hoped you got a different result. Ah, well. Let's go find invincea's costumer support for sandboxie. Hello Durew: Of course I'd prefer Pedro to weigh in on this, but I wonder if sandboxing his mbae-test.exe, defeats the purpose of the exploit test itself? In my system above, when mbae-test is sandboxed, and MBAE is active, mbae-test's Exploit allows calc.exe to launch. As for Invincea, I believe that they may have somehow brought about "tzuk's" untimely departure and it may be an insufferably long time before any useful advances come out of the Sandboxie project. Pity! My 2 cents... Link to post Share on other sites More sharing options...
Staff pbust Posted January 12, 2014 Staff ID:777190 Share Posted January 12, 2014 It is normal that the exploit test executes calc.exe when within Sandboxie, as there is no exploit protection running within Sandboxie. Even if you have MBAE installed, Sandboxie prevents it from injecting applications that are run within Sandboxie. That's why the exploit is able to run within Sandboxie. Link to post Share on other sites More sharing options...
henryg_1 Posted January 13, 2014 Author ID:777433 Share Posted January 13, 2014 Hello Henry: Congratulations on your successful experience. IMHO, MBAE is maturing quite nicely to the extent that soon users can re-examine their use of EMET & hmp.alert And now it doesn't <sigh>. So it's back to MBAE, but does it actually protect me? 'Support' told me in an email that it would not stop Cryptolocker getting on a clean system if the payload was run, so WTF does it do? Isn't a program seeking to encrypt everything an action worthy of user confirmation to proceed? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now