Gone in 60 seconds

happygeek 0 326 Views

In a comprehensive review of the new ZonaAlarm virtualized security environment that is ForceField, Roger Grimes praises the elegant user interface. While admitting to being a big fan of Check Point and the ZoneAlarm brand, Grimes remains skeptical of these kind of virtualization products and it would appear with good reason: because he reveals that the sandbox security client still allowed his test system to be compromised by malware within sixty seconds of browsing.

"ForceField did stop many malicious Web sites from loading and many malicious programs from being installed" Grimes says "it reported stopping more than 16,000 threats from the first seven sites I visited, but my network sniffer showed the true number to be below 60. I'm not sure how ForceField is counting threats."

The reviewer also discovered "many false negatives" and found that ForceField failed to prevent a number of malware infections. "One rootkit was installed as a service" Grimes warns "and several others installed using malformed multimedia content."

Dani AI

Generated

Following ’s link to a review of a sandboxed browser product, a concise, practical addendum is useful: sandboxing reduces risk but does not remove it. The most valuable step after reading any product claim is a short, reproducible lab checklist and clear indicators to decide whether a sandbox behaved as advertised.

A recommended test setup (isolated, snapshot-capable VM) and checklist:

  • Use a clean snapshot of the OS for each run so the environment can be restored exactly.
  • Isolate the VM from production networks (air-gapped or on a monitored VLAN) and capture traffic with an independent network recorder.
  • Run host telemetry: process and file-system monitors, autorun/registry monitors, and a kernel-driver watcher (Sysinternals tools are standard examples).
  • Test a variety of vectors (browser plug-ins, PDFs, media parsing, script injection) in small batches and log timestamps.
  • Compare the product’s internal logs to independent telemetry rather than relying on vendor counts.
  • Revert snapshot and repeat to confirm consistency.

Key indicators that a sandbox was bypassed or containment failed:

  • New persistent services, scheduled tasks, or altered run keys after a session.
  • Newly loaded unsigned kernel drivers or altered system files.
  • Outgoing connections to uncommon external hosts established from high-privilege processes.
  • Processes that survive snapshot reboots or reappear without obvious persistence mechanisms.
  • Differences between vendor logs and independent monitors (mismatched timestamps, missing events).

Practical takeaways: treat sandboxing as one layer in defense-in-depth; minimize attack surface by disabling unnecessary plug-ins, keep browser/OS patched, and require vendors to demonstrate reproducible, third-party tests. Independent, repeatable telemetry is the only reliable way to validate bold detection claims.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview