Test Center: Sandbox security versus the evil Web
Five products strive to trap drive-by downloads and other threats in a virtual Web browsing space, with mixed resultsFollow @infoworld
The DefenseWall HIPS includes a Stop Attack window, which allows a user to quickly close all untrusted processes if a malicious attack is suspected. The Adobe Flash clipboard hijack exploit lived through this closing; DefenseWall HIPS did not report any events or modifications, nor did it offer to roll back any changes.
DefenseWall HIPS also had a hard time cleaning up from the XP Antivirus malware, as did many of the competing programs. Although XP Antivirus was executed from within an untrusted browser session, the malware program was able to permanently modify the system and leave remnants of itself behind, even after I instructed DefenseWall HIPS to close all untrusted processes and delete all resource changes. DefenseWall HIPS did a pretty good job in stopping most malware programs, but it wasn't perfect.
ZoneAlarm ForceField 1.1
Check Point's ZoneAlarm ForceField requires Windows XP Professional SP2 or later, and works with Internet Explorer (6.0 and later) and Firefox (2.0 and later) browsers. It prevents "silent" malware downloading and keyloggers, while providing anti-phishing services, Web site inspection, and privacy components. As shown in Figure 1, ForceField can open a protected or private browser session, the latter of which adds the ability to erase browser session markers. Once a protected browser session is opened, protection is indicated by the additional toolbar (Figure 2).
ForceField accurately prevented silent infections, although it did not prevent the Adobe Flash clipboard hijack. During the first round of testing a few weeks ago I was able to bypass ForceField by using a completely different malicious Flash buffer overflow file. During the later, and longer, second round for this review, ForceField held up without allowing a single silent infection. ForceField's user interface, although not the best in the competition, certainly held its own. Warning messages were easy to understand and presented at appropriate times.
For these reasons, and the fact that I have liked both Check Point and Zone Alarm software for a long time, I wanted to award a glowing review to this product. However, it's hard to give a strong recommendation to a product that only works to prevent "silent" drive-by downloads. While this is good, a fully patched system will do the same, albeit without the same level of warnings. These days, a large portion of malware is intentionally downloaded and installed by the end-user because of incredibly realistic social engineering. This is a hard deficiency to overlook.