4 ms·

When does running malware in a virtual machine (VM) not make sense, is it commonly not possible, etc.?

Kalium 10y ago
In general, dropping a sample into a VM and executing it is an obvious - and dangerous - approach. Real-world malware has been known to detect VMs and refuse to run. Or attack the VM, escape, and infect the host. Broadly, it's not a reliable approach and relies to a surprising extent on the cooperation of the malware package.
- mikevm 10y ago
  How common are VM escapes anyway?
  - mi100hael 10y ago
    Not widespread, but they do exist. https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-2017-day-three-schedule-and-results https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-201...
    - moyix 10y ago
      Not widespread is a bit of an understatement. In the context of malware analysis I would be astonished if someone bothered to use a VM escape bug. They're valuable; you don't waste them by sticking them in a piece of malware to pwn some poor malware analyst's machine. VM detection is much much easier, so there's not much point.
      - Kalium 10y ago
        Yeah. Unless the analyst is your target environment, I wouldn't expect to see it a serious current VM escape. I might expect to see someone including an antique attack against some old Sandboxie or something, but nothing more.
      - matt_wulfeck 10y ago
        I was thinking the same thing. Who would waste an unpatched vm escape bug just to nab some poor souls laptop, which can be wasted and reformatted in an hour? Sounds like a colossal waste and I bit there's very, very few (if any) examples of it happening in the wild.
      - giancarlostoro 10y ago
        I have a feeling escaping from Windows into a Ubuntu host system would not be as effective (though I wouldn't doubt it impossible) as escaping into a Windows OS which is usually the bigger / main target for malware.
    - mirimir 10y ago
      Isn't VMware in Windows rather a special case? They've been working together for so many years, after all. Any known breakouts from Windows guests in VirtualBox on Linux?
      - Kalium 10y ago
        http://venom.crowdstrike.com/ http://venom.crowdstrike.com/ There have been others. In short, no VM is completely safe.
- lawnchair_larry 10y ago
  No real world malware has had a vm escape.
  - spcelzrd 10y ago
    that we know of
problems 10y ago
VMs are extremely useful for malware RE, but there are a few potential concerns: - VM breakouts are a security concern. While fairly uncommon this is a risk. Most of that risk exists in drivers and VM acceleration tools and can be mitigated. - Some malware packers will detect virtual machines and refuse to run. You can bypass this by cracking the VM check of course - but that can sometimes be harder than dumping it on real hardware, depending on the protection and specifics of the situation. These are much bigger concerns if you're working with 0 day high level stuff and not just typical skiddie malware you pulled off usenet or a fake crack in a youtube video. Most of that stuff is just iStealer or a shitty DDoS-focused RAT and whatever "FUD" RunPE packer was on sale for the cheapest price on HackForums or similar that day. Some people will play this up to be a bigger concern than it realistically is - but a VM will protect you from the malware in almost every case I've seen. Just remember to keep your VM software up to date and avoid using unnecessary pieces. My paranoid setup is a dedicated machine with 2 VMs, one victim VM and one router VM, quite similar to their setup there. The difference is, my router VM goes over Tor and doesn't allow traffic from the second interface out in any other way. I also use libvirt with kvm with as few extensions and drivers as possible to prevent most VM-based attacks.
- j_s 10y ago
  If you want to get into VM setup: https://www.blindseeker.com/AVATAR/AVATAR-3-18-17.pdf https://www.blindseeker.com/AVATAR/AVATAR-3-18-17.pdf https://blindseeker.com/blahg/ https://blindseeker.com/blahg/ Also: https://cloudplatform.googleblog.com/2017/01/7-ways-we-harden-our-KVM-hypervisor-at-Google-Cloud-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/01/7-ways-we-harde... | https://news.ycombinator.com/item?id=13483603 https://news.ycombinator.com/item?id=13483603
  - j_s 10y ago
    Also https://twitter.com/Carlos_Perez/status/848698806187307008 https://twitter.com/Carlos_Perez/status/848698806187307008
- lawnchair_larry 10y ago
  VM breakouts are not really a concern though. They're so rare and worth so much that nobody is going to burn them on you.
goatsi 10y ago
Malware will often detect the presence of a VM and refuse to run, requiring you to identify and defeat the VM checks or more insidiously appear to run normally but modify the actions it takes. [0] Generally these problems are solved by modifying the VM so it can no longer be detected. [1] [0] http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html [1] http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478 http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478
- j_s 10y ago
  More VM setup discussion: https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x...

In general, dropping a sample into a VM and executing it is an obvious - and dangerous - approach. Real-world malware has been known to detect VMs and refuse to run. Or attack the VM, escape, and infect the host. Broadly, it's not a reliable approach and relies to a surprising extent on the cooperation of the malware package.

mikevm 10y ago
How common are VM escapes anyway?
- mi100hael 10y ago
  Not widespread, but they do exist. https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-2017-day-three-schedule-and-results https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-201...
  - moyix 10y ago
    Not widespread is a bit of an understatement. In the context of malware analysis I would be astonished if someone bothered to use a VM escape bug. They're valuable; you don't waste them by sticking them in a piece of malware to pwn some poor malware analyst's machine. VM detection is much much easier, so there's not much point.
    - Kalium 10y ago
      Yeah. Unless the analyst is your target environment, I wouldn't expect to see it a serious current VM escape. I might expect to see someone including an antique attack against some old Sandboxie or something, but nothing more.
    - matt_wulfeck 10y ago
      I was thinking the same thing. Who would waste an unpatched vm escape bug just to nab some poor souls laptop, which can be wasted and reformatted in an hour? Sounds like a colossal waste and I bit there's very, very few (if any) examples of it happening in the wild.
    - giancarlostoro 10y ago
      I have a feeling escaping from Windows into a Ubuntu host system would not be as effective (though I wouldn't doubt it impossible) as escaping into a Windows OS which is usually the bigger / main target for malware.
  - mirimir 10y ago
    Isn't VMware in Windows rather a special case? They've been working together for so many years, after all. Any known breakouts from Windows guests in VirtualBox on Linux?
    - Kalium 10y ago
      http://venom.crowdstrike.com/ http://venom.crowdstrike.com/ There have been others. In short, no VM is completely safe.
lawnchair_larry 10y ago
No real world malware has had a vm escape.
- spcelzrd 10y ago
  that we know of

problems 10y ago

VMs are extremely useful for malware RE, but there are a few potential concerns: - VM breakouts are a security concern. While fairly uncommon this is a risk. Most of that risk exists in drivers and VM acceleration tools and can be mitigated. - Some malware packers will detect virtual machines and refuse to run. You can bypass this by cracking the VM check of course - but that can sometimes be harder than dumping it on real hardware, depending on the protection and specifics of the situation. These are much bigger concerns if you're working with 0 day high level stuff and not just typical skiddie malware you pulled off usenet or a fake crack in a youtube video. Most of that stuff is just iStealer or a shitty DDoS-focused RAT and whatever "FUD" RunPE packer was on sale for the cheapest price on HackForums or similar that day. Some people will play this up to be a bigger concern than it realistically is - but a VM will protect you from the malware in almost every case I've seen. Just remember to keep your VM software up to date and avoid using unnecessary pieces. My paranoid setup is a dedicated machine with 2 VMs, one victim VM and one router VM, quite similar to their setup there. The difference is, my router VM goes over Tor and doesn't allow traffic from the second interface out in any other way. I also use libvirt with kvm with as few extensions and drivers as possible to prevent most VM-based attacks.

j_s 10y ago
If you want to get into VM setup: https://www.blindseeker.com/AVATAR/AVATAR-3-18-17.pdf https://www.blindseeker.com/AVATAR/AVATAR-3-18-17.pdf https://blindseeker.com/blahg/ https://blindseeker.com/blahg/ Also: https://cloudplatform.googleblog.com/2017/01/7-ways-we-harden-our-KVM-hypervisor-at-Google-Cloud-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/01/7-ways-we-harde... | https://news.ycombinator.com/item?id=13483603 https://news.ycombinator.com/item?id=13483603
- j_s 10y ago
  Also https://twitter.com/Carlos_Perez/status/848698806187307008 https://twitter.com/Carlos_Perez/status/848698806187307008
lawnchair_larry 10y ago
VM breakouts are not really a concern though. They're so rare and worth so much that nobody is going to burn them on you.

goatsi 10y ago

Malware will often detect the presence of a VM and refuse to run, requiring you to identify and defeat the VM checks or more insidiously appear to run normally but modify the actions it takes. [0] Generally these problems are solved by modifying the VM so it can no longer be detected. [1] [0] http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html [1] http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478 http://www.kernelmode.info/forum/viewtopic.php?f=11&t=3478

j_s 10y ago
More VM setup discussion: https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x...