sandboxie-plus/Sandboxie

[ESET / Kaspersky] Any website shows a connection error on sandboxed Firefox/Edge

Open

#2025 opened on Jul 12, 2022

View on GitHub
 (23 comments) (1 reaction) (0 assignees)C (18,328 stars) (1,985 forks)batch import
Browser: ChromiumBrowser: FirefoxHelp WantedIssue: ReproducedSoftware: ESETSoftware: KasperskyWorkaround

Description

Describe what you noticed and did

  1. Add SandboxieLogon=y in [GlobalSettings] (see here to enable it from Sandboxie Plus GUI)
  2. Visit any website in sandboxed Firefox/Edge
  3. Firefox "PR_CONNECT_RESET_ERROR"/Edge "ERR_CONNECTION_RESET"
Note: in order to reproduce this issue reliably, it is recommended to open a non-cached website in a new tab with both sandboxed browsers, while having in the system any ESET/Kaspersky Internet Security suite. Microsoft Defender is not affected.

How often did you encounter it so far?

No response

Affected program

Firefox 102, Edge 103

Download link

Not relevant

Where is the program located?

The program is installed only outside the sandbox.

Expected behavior

This bug shoudn't appear.

What is your Windows edition and version?

Windows 10 Enterprise LTSC 2021 x64 (21H2) (10.0.19044.1806)

In which Windows account you have this problem?

Not relevant to my request.

Please mention any installed security software

ESET Internet Security 15.2.11.0 x64 / Kaspersky Internet Security

What version of Sandboxie are you running?

Sandboxie 5.57.0/5.57.1 x64, Sandboxie-Plus 1.2.0/1.2.1 x64

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression?

Sandboxie 5.57.0/Sandboxie-Plus 1.2.0

In which sandbox type you have this problem?

Not relevant to my request.

Can you reproduce this problem on an empty sandbox?

I can confirm it also on an empty sandbox.

Did you previously enable some security policy settings outside Sandboxie?

No response

Crash dump

No response

Trace log

No response

Sandboxie.ini configuration

No response

Contributor guide

Tech stack
c
Domain
security
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
C programmingWindows system programmingnetwork stack knowledgeantivirus driver interaction
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
15
Research direction
Investigate Sandboxie's network hooking mechanism, particularly how it intercepts connections via TDI or WFP filters. Review the SbieDrv driver code to understand how it handles connection requests and why ESET/Kaspersky might cause a reset. Reproduce the issue with the SandboxieLogon=y setting and examine the network trace to identify where the connection is being reset. Look for any existing comments or commits in the repository related to network hooking or antivirus compatibility.