(2nd Try) Safepay, Keyloggers And Screenscrapers

Does SafePay somehow block keyloggers and screenscrapers that may be active on the computer?

Yes. There are a handful of countermeasures against this:

- Safepay runs in a separate desktop which does *not* allows hooks to be set (that is, including keyboard hooks) from another desktop, even if present;

- even so, there is the Virtual Keyboard (which should pop automatically when focus is on an editable password input element) which allows you to type passwords or other sensitive data and does *not* use keyboard messages (subject to trap) but rather comunicates internally directly to browser (so no keyboard interception can get the characters 'typed' in virtual keyboard)

- for screenshots, Safepay intercepts all combinations of Print Screen (Alt, Ctrl, Shift, Win - all of them) and pressing, say, PrtScr will get consumed by Safepay itself (which does nothing), so in Clipboard won't arrive any bitmap.

Consider the situation where (unbeknownst to me) I have very stealthy keylogger and screenscraper malware active on my Windows computer.

That's why Bitdefender scans the computer when installing. It is always recommended to scan regularly for malware anyways - without trying to sell you a false sense of protection, if kernel mode gets infected, then a malware can do pretty much everything already.

There are plans to integrate quick scan anyways to assess and clean the computer before a Safepay session begins. Stay tuned !

I start up SafePay and then type in www.mybank.com, and then proceed to enter my user name and password. Can the keylogger and screenscraper grab the keystrokes and screenshots? If not, how does SafePay stop keyloggers and screenscrapers from working within SafePay?

If a BitDefender forum moderator can say with 99% confidence that keyloggers and screenscrapers cannot capture data within SafePay sessions, then that will be good enough for me.

See above.

Any details you can provide on how SafePay actually works would be most appreciated. From what I've seen SafePay looks like a great feature.

It is basically a browser with attack surface greatly reduced. Other than the features above (separate desktop, virtual keyboard, print screen interception), here's a handful of them:

- does not load NPAPI plugins (except Flash which is everywhere)

- does not load *any* browser extensions at all

- if the connection is wireless and this is insecure (Open protection) then a VPN connection is dialed to Bitdefender, and for each navigation to an URL, if its domain is a bank, then a route thru the VPN connection is created so the traffic to www.mybank.com will route to Bitdefender VPN, while the normal traffic will use the existing connection as before (the VPN implementation already exists; the routing implementation is about to be released)

- uses separate location for cookies and local storage, which is protected by shield service

Regards,

Cristian

It says you're a newbie but it sounds like you're a BitDefender empyee and develper.

I am the lead developer for Safepay, so I think I can provide you information at first hand

Thanks for all the great info. Let me see if I can summarize my understanding:

SafePay is safe as long as the user does the following:

* Scans for and removes all rootkits (I presume "kernel mode malware" and a rootkit are the same thing. That true?).

Technically they are not equivalent; kernel mode malware being a generic class of malware programs executing in kernel mode - which teoretically have unrestricted access to pretty much everything in the operating system. Bitdefender have a top notch detection and removal for rootkits, but I am not an AV developer, so I suggest you to look for extensive informations in Antivirus forum, Bitdefender product website and product documentation for best usage and capabilities.

There are a number of good rootkit removers out there. I presume BitDefender has some kind of pre-boot scanner to remove rootkits? This true? If BitDefender periodically did a pre-boot rootkit scan, then the rootkit threat would be much reduced. Is there some way to check for rootkit infections after boot?

Yes, Bitdefender have a number of drivers executing at boot time and scanning for multiple sorts of root malware, as well as on-demand scan (if activated) and scheduled scans.

* Scans for and removes all regular malware. Which is of course what BitDefender does if it's set for regular scans.

Exactly. A better degree of deterministic scans (i.e. not residing just on scheduled or demand scan) is always possible, meaning "do scan if I am doing this (example: using Safepay)", but there is always the tradeoff between "keep the system safe at all costs, even if user is annoyed by so extensive scans" and "user knows what's best for him". I suppose a common usage can be (a) schedule a scan on Monday morning and ( use Safepay during the week, but that, as you can imagine, varies greatly from user to user, which also doesn't want to be annoyed all the time for the greater good.

* Uses the virtual keyboard.

To be honest, the average user has no clue about rootkits. And if rootkits are not scanned for and removed, then SafePay could be compromised. That seems to be one serious weak point of SafePay for the average user. That true? My understanding is that rootkits are becoming more and more common and effective and stealthy.

Not especially. While you are right saying the average user doesn't know about rootkits, that's why Safepay have, for instance, a virtual keyboard. The user doesn't need to know a theory like 'if you have explorer infected and a keyboard hook installed, it can't set a hook in Safepay's desktop because that desktop does not allow hooks set from another desktops' or 'the virtual keyboard does not send keyboard messages to windows'. It's enough to say that a listener on keyboards won't see any key pressed from virtual keyboard because there is no key pressed - it's as simple as that.

Sound like SafePay runs in a special separate desktop space just like mutiple users can have their own accounts and desktops. That true? And it sounds like the SafePay desktop space is special with lots of features to keep it very isolated from most running processes.

Is a similar process, yes, only the separation is done at the desktop level in the same logon session - short story, you can have multiple windows stations (the one you are logged on, the Winlogon one that you see pressing Ctrl-Alt-Del etc.) and each such "station" can have multiple desktops. Safepay uses a desktop in the user station, only separated from other desktops exactly from preventing tampering from other programs running in the "normal" desktop.

Nice discussion between Advait and Cristian Amarie.

I copy any text and can paste in the SafePay and vice versa. Is this normal, because it means that Windows clipboard is still using in SafePay also?

Also Cristian is talking about Scheduled Scan in his posts, but as far as I know Bitdefender 2013 don't have such feature as a new feature of AutoScan.

And also there is no answer to the question "Is the SafePay browser fully sandboxed?"

I don't understand the integrate Quick Scan before the start of SafePay session? Isn't it will be complicated when Quick Scan founds infection(s) while we are in hurry to use SafePay?

About keyloggers, Bitdefender (even with AVC and IDS enabled while no HIPS protection is available in Bitdefender) or any antivirus cannot detect all keyloggers available, using SafePay will not be useful if it is not fully snadboxed.

1. Yes, Windows clipboard is used by Safepay. And yes, this is normal, since is a feature. Disabling clipboard will cripple Safepay, since users needs it. Nonetheless, it could be possible to refine this idea, thought, by adding, say, extra layers of security regarding clipboard. The user will copy and URL and paste into address, then navigate to it; while it could be possible that a malware to replace with a "bad" url (although VS shield will probably catch it), Safepay also sends the URL to scan and retrieve various flags *before* navigating. A malware URL will be blocked also by Safepay itself, even if virus shield is not working.

2. About scheduled scans: my confusion (I am not working on scan modules). It was replaced by AutoScan, indeed. My bad.

3. "Is the SafePay browser fully sandboxed?" I suppose the answer depends on what one may consider to be a sandbox.

For example, if you ask questions such as "does Safepay accesses the file system", for example, the answer is "yes, but in a single location for cookies/storage which is defended by self protect".

=== Sandbox ===

In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third-parties, suppliers, untrusted users and untrusted websites.[1]

The sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted. In this sense, sandboxes are a specific example of virtualization.

IMHO Safepay does (1) separate running programs, offers (2) a tightly controlled set of resources for guest (Safepay itself is its own sandbox, from this point of view), (3) have limited and controlled access to host (self-protected location for cookies and internet files mentioned above).

An exception can be the download which uses a My Documents subdirectory for storing downloaded user files. But in this case Safepay just downloads them, does not execute, nor opens them since these are user's files, not Safepay's.

I hope this brings a description on how Safepay relates to a sandbox. While tehnically it is not 100% a sandbox, overall I think it scores on (almost) all points describing one.

Regards,

Cristian