sandbox Making a better sandbox The effectiveness of a sandbox largely depends on its ability to realistically imitate a working environment. Dmitry Reznikov May 25, 2023 Sandboxing is one of the most effective tools there is for analyzing suspicious objects and detecting malicious behavior. Different implementations of this technology are used in a wide range of security solutions. But the accuracy of threat detection depends directly on the way the sandbox emulates the environment in which suspicious objects are run. What is a sandbox and how does it work A sandbox is a tool that creates an isolated environment in which the behavior of suspicious processes can be analyzed. This usually takes place in a virtual machine or container, which allows the analyst to examine potentially malicious objects without the risk of infecting or damaging a real working environment or leaking important corporate data. For example, the sandbox in the Kaspersky Anti Targeted Attack (KATA) Platform works as follows: if some component in the security solution detects a dangerous or suspicious object (for example, a file or URL), it’s sent to the sandbox for scanning, along with the details of the working environment (OS version, list of installed programs, system settings, etc.). The sandbox runs the object or navigates to the URL, recording all artifacts: Execution logs, including system API calls, file operations, network activity, URLs and processes accessed by the object System and memory snapshots (dumps) Created (unpacked or downloaded) objects Network traffic After the testing scenario completes, the collected artifacts are analyzed and scanned for traces of malicious activity. If those are found, the object is flagged as malicious, and the techniques, tactics and procedures identified are mapped to the MITRE ATT&CK matrix. All data retrieved is stored for further analysis. Sandbox challenges The main problem with sandboxes is that cybercriminals know about them and constantly refine their evasion methods. To circumvent sandbox protection, attackers focus on developing technologies to detect specific features of virtual environments. They do this by looking for characteristic artifacts or states of the sandbox, or unnatural behavior of the virtual user. Having detected (or even just suspected) such signs, the malicious program alters its behavior or self-destructs. In the case of malware used for targeted attacks, cybercriminals meticulously analyze the configuration of the operating system and the set of programs used on the target machine. Malicious activity is triggered only if the software and system fully comply with the attackers’ expectations. The malware can work at strictly defined time intervals or activate after a certain sequence of user actions. How to make an artificial environment more real To fool a potential threat into running in a secure environment, combinations of different approaches are deployed: Variable and randomized virtual environments: creation of multiple sandboxes with different combinations of settings and installed software Realistic simulation of user behavior, including the speed of typing passwords, viewing text, moving the cursor, clicking the mouse Use of a separate physical (non-virtual) machine isolated from the working environment to analyze suspicious objects related to hardware attacks and device drivers A combination of static and dynamic analysis; monitoring of system behavior at certain time intervals; use of time-acceleration technologies on virtual machines Use of images of real workstations from the target environment, including operating system and configuration of programs, plug-ins and security settings Our sandbox implements all of these techniques: it can emulate the behavior of a real user, deploy randomized environments, and operate in manual or automatic mode. And we’ve recently updated our extended detection and response solution – Kaspersky Anti Targeted Attack Platform. The integrated sandbox now lets you use custom system images with a choice of OS (from the list of compatible ones) and install third-party programs. More information about the platform is available on the dedicated KATA page.
Read next Brief cheat-sheet on cloud types and their risks Сloud technologies differ in terms of both costs and risks. What cloud type should you choose, and how should you begin your migration?
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.