64 bit as good as 32 bit possibility?

[securitynoob]

Okay, as we know, there are now 64 bit rootkits that are able to get through by patching the MBR. Do you guys thank that it would be possible to use the same software with Sandboxie. Would it cripple the system? If not, since once they do this they can then load drivers, wouldn't the 64 bit version protect you just as well?

[Dieselman]

All you need to know is right in this link. bIf you want the best protection possible then get an external HDD and make a clean system image. Get a rootkit................Mount a clean image and your back like nothing ever happened.

http://www.sandboxie.com/index.php?Note ... BitEdition

[securitynoob]

What I'm saying is that is it possible for the 64 bit version of Sadnboxie to work as well as the 32 bit version if they take advantage of this MBR patching idea. I know that a clean image can help, but fot those people who can't, or DON't do this, it could be a good idea as a first line of defense.

[Dieselman]

Did you even read the link I provided? If you did then you would not be asking this again. Let me point out what you clearly missed.

Full disclosure: The 64-bit edition of Sandboxie provides a reduced level of protection compared to the 32-bit edition of Sandboxie.

[securitynoob]

Alright, let me rephrase this... so maybe you can understand. Maybe I wasn't being that clear...

Right now, I KNOW THAT THE 64 BIT VERSION OF SANDBOXIE CANNOT PROTECT YOU AS WELL AS THE 32 BIT VERSION!!!!! What I'm asking is this: If, in a future update to the 64 bit version of Sandboxie, they included some of the same software that this rootkit is using, where is patches the Master Boot Record after a re-boot, and then starts it's kernel modification before Windows is fully prepared to prevent it, would it then allow the same level of protection that the 32 bit version of Windows provides? I KNOW THAT 64 BIT ISN'T CURRENTLY as good as the 32 bit version. I'm asking if they take advantage of this, will it provide more, possible as much, protection as the 32 bit version?

[Dieselman]

Well that's not a question to ask in here. We do not make Sandboxie. Ask this question over at the Sandboxie forums.

[securitynoob]

I'm asking it over there, too: http://www.sandboxie.com/phpbb/viewtopic.php?t=8953. I just wanted to know, if in your guys opinion, whether or not this could work.

[bogdan]

Win7x64 took upon itself the task of protecting the kernel. Basically Microsoft is asking all software authors to provide security without messing with the kernel.

What you are proposing is exactly what happened with 32bit OSs for a long time. Both malware and security software authors were using non-recommended ways (exploits) to get powerful privileges.

For the moment I think we should let Microsoft stand up to its promise and patch the bug. If it fails to do so (or it isn't possible to do it), I'm sure we will go back to the way security was implemented in the 32bit OSs.

[Kyle]

When using 64b sandboxie, It defaults to "drop rights" feature on all created sandboxes. Using this feature, it is as secure as 32b. Without it disabled, 32b is more secure. Because of this "patch guard" Security companies cannot hook into the system as they used to and are trying to find other ways to achieve a similar outcome.... This is across the board and not just sandboxie.