3 ms·
How common are VM escapes anyway?
by mikevm 10y ago
How common are VM escapes anyway?
- mi100hael 10y agoNot widespread, but they do exist. https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-2017-day-three-schedule-and-results https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-201...
- moyix 10y agoNot widespread is a bit of an understatement. In the context of malware analysis I would be astonished if someone bothered to use a VM escape bug. They're valuable; you don't waste them by sticking them in a piece of malware to pwn some poor malware analyst's machine. VM detection is much much easier, so there's not much point.
- Kalium 10y agoYeah. Unless the analyst is your target environment, I wouldn't expect to see it a serious current VM escape. I might expect to see someone including an antique attack against some old Sandboxie or something, but nothing more.
- matt_wulfeck 10y agoI was thinking the same thing. Who would waste an unpatched vm escape bug just to nab some poor souls laptop, which can be wasted and reformatted in an hour? Sounds like a colossal waste and I bit there's very, very few (if any) examples of it happening in the wild.
- giancarlostoro 10y agoI have a feeling escaping from Windows into a Ubuntu host system would not be as effective (though I wouldn't doubt it impossible) as escaping into a Windows OS which is usually the bigger / main target for malware.
- mirimir 10y agoIsn't VMware in Windows rather a special case? They've been working together for so many years, after all. Any known breakouts from Windows guests in VirtualBox on Linux?
- Kalium 10y agohttp://venom.crowdstrike.com/ http://venom.crowdstrike.com/ There have been others. In short, no VM is completely safe.