[HOWTO] Use a Sandbox for Malware Protection

Run Your Sketchy Software in a Sandbox

When kids play in a sandbox, they can create their own worlds, complete with roads, castles, and armies. But, like a visit to Las Vegas, what happens in the sandbox, stays in the sandbox. Sandboxes are useful in the computing world as well, though.

In the digital sense, a sandbox is a "walled-off" controlled environment where currently running software cannot access most of your system resources. Software sandboxes have been used for decades by software developers to test unfinished programs safely. You may already be using sandbox technology without knowing it. Javascript, for example, is a popular tool used to add functionality to web pages. When your browser loads a page that contains Javascript, that code runs in a virtualized environment (a sandbox) that allows it to add, delete or change items on that page, but blocks it from accessing other resources.

Sandboxie Plus is a free, open-source sandbox environment designed for testing software that one may download from the Internet. It creates an isolated environment that prevents software running within it from making permanent changes to other programs or files on your system. Any instructions to change files issued by the suspect program are redirected to a specified area of the hard drive - the sandbox - where they can easily be deleted when the program is terminated.

How Does a Sandbox Protect Me?

You can run your Web browser, install and run newly-downloaded programs, or open suspicious files inside of Sandboxie, erecting a "wall" around these common sources of malware infections. If you happen to get infected with a virus while running in a sandbox, just delete the sandbox, and the problem is gone. Even the Windows registry is safe from rogue software, while operating inside a sandbox environment.

Changes that a sandboxed program wants to make to your system are, instead, stored in the sandbox cache. The user can allow all cached changes to be deleted when the sandbox session is ended, or you can review the changes in the cache and select those you would like to make permanent. Changes you might want to save include emails or documents you have created or received from trusted sources during a session.

Sandbox technology is not intended to replace traditional anti-malware protection. Loading and unloading a sandbox application like Sandboxie is inconvenient compared to the silent, real-time malware scanning of a typical antivirus program. Sandboxes are not entirely leak-proof, either. If there's a way for the user to save changes stored in the cache, then a bad guy may find a way to exploit this hole in the sandbox wall.

Other Virtualized Environments

Windows 10 and 11 (Pro and Enterprise editions) have a sandbox feature included, but it's not turned on by default. To enable Windows Sandbox, click the Start button, type Windows Features and press Enter. The list of Windows Features will appear. Scroll down until you find Windows Sandbox, place a check next to that item, and press OK. Windows will install the Sandbox feature and prompt you to restart your computer.

After restarting, to start the Sandbox environment, click Start, type Sandbox, and press Enter. A pristine Windows environment will appear inside a new window on your desktop. Copy and paste the program file you want to run into the Windows Sandbox and run it like you normally would. Every time you use the Windows Sandbox, it's effectively running your program in a brand-new installation of Windows. When you close the application, everything in the sandbox (software, files, settings) goes poof!

Here's a video of Windows Sandbox in action, along with an interesting use case. In this scenario, the owner of a business receives a spreadsheet from a recently terminated employee. The spreadsheet purports to be a list of unfilled orders, but the owner is wary that it might be something malicious. He launches the sandbox, drags the suspicious file inside, and discovers that his spider sense was right.

NOTE: If you have the Home Edition of Windows 10 or 11, there's an unofficial workaround to install Windows Sandbox. See Install and use Windows 11 and 10 Home Windows Sandbox.

I wasn't able to find anything similar to Sandboxie or Windows Sandbox for Mac OS users. App developers can choose to have their code run in a macOS App Sandbox environment, in which the app is limited to a minimum set of privileges. If the app tries to access a restricted resource or protected file location, the system will block it. Sandboxing is required for any app submitted to the Mac App Store. There doesn't seem to be a way to open the sandbox environment and test a newly-downloaded program or file of your choosing.

A Virtual Machine is another option. Think of it as a sandbox on steroids. Instead of creating a wall around one specific program, a virtual machine is a complete computing environment that exists on a temporary basis. You can, for example, start up a virtual copy of another version of Windows, Linux or other guest operating systems. Virtual machines are outside the scope of this article, but you can learn more at the VirtualBox website and download the free VirtualBox software to try out your own virtual machine.

Docker Desktop is something similar you can check out if you are a Linux user.

If you have an occasional need to test-drive suspect software, or if you often surf where angels fear to tread, a sandbox or virtual machine can be an additional layer of protection. Have you used a sandbox to check out a newly-downloaded file of document? Your thoughts on this topic are welcome! Post your comment or question below...