We introduce a new security model for NetBSD – secmodel sandbox – that allows per-process policies for restricting privileges. Privileges correspond to kauth authorization requests, such as a request to create a socket or read a file, and policies specify the sandbox’s decision: deny, defer, or allow. Processes may apply multiple sandbox policies to themselves, in which case the policies stack,...

W hen Java technology burst onto the Internet scene in 1995, its developers declared the ambitious goal of providing a safe programming environment, especially for Web-based, dynamically composed, and mobile applications.1,2 OEM vendors and licensees could port the Java platform to their environment, such as browsers and operating systems, and inherit extensive built-in security features. Java’...

Expecting the shipment of 1 billion Android devices in 2017, cyber criminals have naturally extended their vicious activities towards Google’s mobile operating system. With an estimated number of 700 new Android applications released every day, keeping control over malware is an increasingly challenging task. In recent years, a vast number of static and dynamic code analysis platforms for analy...

MBOX is a lightweight sandboxing mechanism for nonroot users in commodity OSes. MBOX’s sandbox usage model executes a program in the sandbox and prevents the program from modifying the host filesystem by layering the sandbox filesystem on top of the host filesystem. At the end of program execution, the user can examine changes in the sandbox filesystem and selectively commit them back to the ho...

We report on an overhaul to the Sonification Sandbox. The Sonification Sandbox provides a cross-platform, flexible tool for converting tabular information into a descriptive auditory graph. It is implemented in Java, using the Java Sound API to generate MIDI output. An improved modular code structure provides a strong user interface and model framework for auditory graph representation and mani...

[1] In this study, a geostatistically based estimator is developed that simultaneously includes all observed transient hydrographs from hydraulic tomography to map aquifer heterogeneity. To analyze tomography data, a data preprocessing procedure (including diagnosing and wavelet denoising analysis) is recommended. A least squares approach is then introduced to estimate effective parameters and ...

Legacy systems provide services that remain useful beyond the means of the technology in which they were originally implemented. Our Legacy Wrapper tool packages the services of a legacy application in order to redistribute as a distributed object. In this new environment, the wrapper provides its own layer of security between the security domains of the host and the distributed object system. ...

Sandboxing is one of the most promising technologies for safely executing potentially malicious applications, and it is becoming an indispensable functionality of modern computer systems. Nevertheless, traditional operating systems provide no special support for sandboxing; a sandbox system is either built in the user level, or directly encoded in the kernel level. In the user-level implementat...

In order to limit the damage of malware on Mac OS X and iOS, Apple uses sandboxing, a kernel-level security layer that provides tight constraints for system calls. Particularly used for Apple iOS, sandboxing prevents apps from executing potentially dangerous actions, by defining rules in a sandbox profile. Investigating Apple’s built-in sandbox profiles is difficult as they are compiled and sto...

This paper presents an architecture and implementation of a selfhealing sandbox for the execution of third party code dynamically loaded which may potentially put in risk application stability. By executing code in a fault contained sandbox, no faults are propagated to the trusted part of the application. The sandbox is monitored by a control loop that is able to predict and avoid known types o...