5 ms·

You can buy a laptop for $200 on amazon. Burner laptops could make good sandboxes, no? It's about as powerful as an iphone https://www.amazon.com/gp/aw/d/B01F4

by Swizec 10y ago

You can buy a laptop for $200 on amazon. Burner laptops could make good sandboxes, no? It's about as powerful as an iphone https://www.amazon.com/gp/aw/d/B01F4ZG68A/ref=mp_s_a_1_5?ie=UTF8&qid=1474762623&sr=8-5&pi=AC_SX236_SY340_QL65&keywords=laptop&dpPl=1&dpID=41S0oyNX1HL&ref=plSrch https://www.amazon.com/gp/aw/d/B01F4ZG68A/ref=mp_s_a_1_5?ie=...

dogma1138 10y ago
Yes but they don't scale, and you still have a problem of figuring out what the malware does you can't attach a debugger to it, and in circuit debuggers for modern machines are non-existent (unless you are Intel/NSA).
- pmoriarty 10y ago
  You can record the contents of the disk before you run the malware and after, and then do a diff. You can also sniff network traffic. I'm not sure how long you'd want to wait to give it a green light, if it doesn't do anything obviously bad, though. Maybe this could be combined with forwarding the clock to trick the malware in to thinking a lot of time has passed?
  - dogma1138 10y ago
    Diffing the disk won't do you much good, the malware does it's interesting things in memory. Overall as I said this doesn't scale.
    - pmoriarty 10y ago
      Viruses can spread copies of themselves and infect other programs, and can leave trails on the disk. They can also infect the mbr. Then there's ransomware which encryptes files on disk. These are all examples of malware that could be detected by diffing the disk. Of course, if it doesn't touch the disk, then you're left with network traces.
      - dogma1138 10y ago
        I'm not saying they don't it just not the most interesting thing you may want to look at ;) Anyhow don't bother with even trying to use physical machines as your primary platform, VM or better instruction level emulation is the way to go, not foolproof but it is at least scalable and flexible enough. You also seem to conflict what detection means, detection can be easy "is this a known binary" if not > malware can be a pretty easy (if unrealistic) classification, when researchers talk about detecting malware we are talking about understanding what it does. Diffing disks isn't really going to get you far.
- Senji 10y ago
  I can assure you, usb or pci DMA debuggers exist. You raise an interrupt and dump all memory with it.
zerognowl 10y ago
Depends on your threat model. Whilst a bare-metal solution is preferable for analyzing malware, I wouldn't procure my laptop from Amazon. See this: https://www.reddit.com/r/onions/comments/301itv/buying_your_laptop_anonymously_and_guarding_it_to/ https://www.reddit.com/r/onions/comments/301itv/buying_your_... After the Snowden revelations, I am highly skeptical of the trustworthiness of any computer hardware ordered online. Even if I don't fall into the bucket of somebody especially interesting or worth targeting. I mean really we should have a database of xray scans of motherboards so we can diff them, and compare store-bought laptops with ones shipped via mail, but until then I will be persistently buying up all the store-bought Thinkpads I can find and modifying them to prevent evil maid attacks.

by Swizec 10y ago

dogma1138 10y ago

Yes but they don't scale, and you still have a problem of figuring out what the malware does you can't attach a debugger to it, and in circuit debuggers for modern machines are non-existent (unless you are Intel/NSA).

pmoriarty 10y ago
You can record the contents of the disk before you run the malware and after, and then do a diff. You can also sniff network traffic. I'm not sure how long you'd want to wait to give it a green light, if it doesn't do anything obviously bad, though. Maybe this could be combined with forwarding the clock to trick the malware in to thinking a lot of time has passed?
- dogma1138 10y ago
  Diffing the disk won't do you much good, the malware does it's interesting things in memory. Overall as I said this doesn't scale.
  - pmoriarty 10y ago
    Viruses can spread copies of themselves and infect other programs, and can leave trails on the disk. They can also infect the mbr. Then there's ransomware which encryptes files on disk. These are all examples of malware that could be detected by diffing the disk. Of course, if it doesn't touch the disk, then you're left with network traces.
    - dogma1138 10y ago
      I'm not saying they don't it just not the most interesting thing you may want to look at ;) Anyhow don't bother with even trying to use physical machines as your primary platform, VM or better instruction level emulation is the way to go, not foolproof but it is at least scalable and flexible enough. You also seem to conflict what detection means, detection can be easy "is this a known binary" if not > malware can be a pretty easy (if unrealistic) classification, when researchers talk about detecting malware we are talking about understanding what it does. Diffing disks isn't really going to get you far.
Senji 10y ago
I can assure you, usb or pci DMA debuggers exist. You raise an interrupt and dump all memory with it.

zerognowl 10y ago

Depends on your threat model. Whilst a bare-metal solution is preferable for analyzing malware, I wouldn't procure my laptop from Amazon. See this: https://www.reddit.com/r/onions/comments/301itv/buying_your_laptop_anonymously_and_guarding_it_to/ https://www.reddit.com/r/onions/comments/301itv/buying_your_... After the Snowden revelations, I am highly skeptical of the trustworthiness of any computer hardware ordered online. Even if I don't fall into the bucket of somebody especially interesting or worth targeting. I mean really we should have a database of xray scans of motherboards so we can diff them, and compare store-bought laptops with ones shipped via mail, but until then I will be persistently buying up all the store-bought Thinkpads I can find and modifying them to prevent evil maid attacks.