4 ms·

This is pretty neat, however I wonder about the risks. Is there any malware that detects that it's running under something like VirtualBox and changes is behav

This is pretty neat, however I wonder about the risks. Is there any malware that detects that it's running under something like VirtualBox and changes is behaviour? Are there any security exploits in VirtualBox that malware could take advantage of to infect the host OS? Regardless of the risks, this is still a neat way to analyze an unknown system (whether a single program or a suite of programs that run across multiple machines).

christophetd 9y ago
Thanks for the feedback :-) As I mentioned at the end of the post, there are indeed malwares that detect being run in a virtual environment and who change their behavior (e.g. do nothing). I'm not an expert at all on the topic, but I was recommended https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x... on the subject. I'm interested if somebody has additional resources to provide.
Namidairo 9y ago
There have been many examples of malware detecting being run in a virtual machine to discourage analysis. (I would note that one obvious sign would be the presence of the guest additions and/or the fact that the PCI bridge will almost always be an i440fx or Q35...) As for VM escapes... Can't guarantee there won't be a sample that comes along eventually that'll try.
BrainInAJar 9y ago
Lots of malware will detect it's running virtualized and change behaviour (generally to "do nothing") and there are mitigations around this detection (removing virtualbox/vmware specific serial numbers, virtualization drivers, etc) but exploits are hard, they are generally tied to a very specific version of very specific software in order to be successful, versions and products the author can't predict (are the hostile analysts running VMWare? Virtualbox? Xen? Mysteries...) and the target surface is likely very low since most malware is just going to be classified by some overworked junior analyst at an antivirus as "GENERIC.W32.RAT" well before it gets any sort of in-depth analysis and binned. Ultimately you shouldn't worry about VM escapes by any malware you're likely to come across, they're an academic threat. Weirdly, as a side effect of the first point, simply installing the virtualbox & vmware drivers on your real actual machine can stop a small subset of malware because it thinks it's running virtualized and shuts down
- SomeStupidPoint 9y ago
  I don't know that I'd say VM escapes are an academic threat -- more that they're used for targeted attacks and not generic malware (usually). Xen, VMWare, and presumably the others seem to get about 1 escape a year that's a serious vulnerability (and 2-3 other ones that could potentially be, but don't seem easily exploitable). Of course, that's publicly disclosed ones, which means there may be more that we're unaware of.
empath75 9y ago
There have been vm escape vulnerabilities published in the past (although none have been exploited that I know of.) http://venom.crowdstrike.com/ http://venom.crowdstrike.com/
- j_s 9y ago
  Depends on your definition of exploited; definitely nothing WannaCry-style yet! https://www.google.com/#q=Pwn2Own+2017+VM+escape https://www.google.com/#q=Pwn2Own+2017+VM+escape Virtual machine escape fetches $105,000 at Pwn2Own hacking contest | https://arstechnica.com/security/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/ https://arstechnica.com/security/2017/03/hack-that-escapes-v... "We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine," Qihoo 360 Executive Director Zheng Zheng wrote in an e-mail. "Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website." http://www.vmware.com/security/advisories/VMSA-2017-0006.html http://www.vmware.com/security/advisories/VMSA-2017-0006.htm... -- All that given up for only fame + ~$100k!
Dolores12 9y ago
Get cheap baremetal cloud server. Pay hourly. Avoid all risks.(at expense of cloud server provider :)
- toomuchtodo 9y ago
  I wonder if there's a need for a malware tear down service; submit a JSON request with the binary defined as part of the request, a spot instance spins up, allows the malware to run, and then all of the MITM network traffic and the instance memory snapshot is dropped into S3 for forensic exploration and collaboration. Forensic malware analysis as a service.
  - Kalium 9y ago
    That's a very interesting idea! Certainly it's an interesting take on the sandbox, and might allow for access to analysis tools even for those without the required tools or skillset. Malware is a threat to us all, and anything offering to democratize analysis is well worth considering. With that said, I can perhaps see a couple of potential sources of additional complexity. First, a spot instance can't really offer the required level of sandboxing. A typical analysis scenario exploits the privileged position a VM host has over the guest to further analysis and safety. Attempting to do so from a peer position is more difficult and may put you in a more limited position to observe all potential behavior as you lose the ability to easily fake DNS, alter the clock, and more. Second, it's possible that cloud hosting service providers might run services designed to look for and shut down malware-infected hosts. It would certainly be in their general interest and probably in the general interest of most of their customers. In such a scenario, it's very possible that a service like that you describe might find all analysis attempts shut down instantly rather that be able to even attempt to gather useful behavioral evidence. Your idea is great! It's well worth exploring and holds amazing potential. It may perhaps be best done with the above caveats in mind.
    - toomuchtodo 9y ago
      Thank you! I'll explore the use of ephemeral VPCs for this tonight; that should allow for the level of network isolation (and possibly traffic routing through another VPC with network traffic inspection tooling) necessary.
celticninja 9y ago
As we saw with the recent Ransomware attack malware doesn't behave differently if it realises it is in a sandbox, however to date that has usually been to deactivate itself to reduce the likelihood of it being analysed. I imagine a virtualbox 0 day would be useful in these situations but probably only to state level actors or malware authors looking to get one up on security firms.
phaus 9y ago
Using a VM is the standard way to analyze malware. There is a threat, but its not considered to be significant at this point. If you were analyzing a malware sample that you knew for a fact performed VM escape, you would run it in a VM on a system specifically designated for that purpose. There are lots of ways that malware can detect the presence of a virtual environment, but part of reverse engineering malware involves defeating these mechanisms. Here's just a few simple ways that malware can detect the presence of a VM: - Size of the hard drive. (people frequently use smaller amounts of storage space for virtual environments). - Presence of a debugger. - Scanning for common analysis tools (regshot, process monitor, ollydbg, etc. - Processes associated with VMware - Network connectivity (like we recently observed) If anyone's interested in learning malware analysis, practical malware analysis is a great book for someone that's already decent at programming. I'd also recommend learning assembly pretty well before you get started.
tjoff 9y ago
About 20% between 2012 and 2014 [1], I actually believe it was much more earlier when few used VMs for production. That meant that a virus could assume that if it were executing in a VM context they were being monitored and altered their behavior to either play nice or distract. Nowadays a VM target could be just as valuable as any other. [1] https://www.symantec.com/connect/blogs/does-malware-still-detect-virtual-machines https://www.symantec.com/connect/blogs/does-malware-still-de...
alexchantavy 9y ago
> Is there any malware that detects that it's running under something like VirtualBox and changes is behaviour? Yup, see Blue Pill/Red Pill (https://stackoverflow.com/questions/154163/detect-virtualized-os-from-an-application https://stackoverflow.com/questions/154163/detect-virtualize...).

christophetd 9y ago

Thanks for the feedback :-) As I mentioned at the end of the post, there are indeed malwares that detect being run in a virtual environment and who change their behavior (e.g. do nothing). I'm not an expert at all on the topic, but I was recommended https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x... on the subject. I'm interested if somebody has additional resources to provide.

Namidairo 9y ago

There have been many examples of malware detecting being run in a virtual machine to discourage analysis. (I would note that one obvious sign would be the presence of the guest additions and/or the fact that the PCI bridge will almost always be an i440fx or Q35...) As for VM escapes... Can't guarantee there won't be a sample that comes along eventually that'll try.

BrainInAJar 9y ago

Lots of malware will detect it's running virtualized and change behaviour (generally to "do nothing") and there are mitigations around this detection (removing virtualbox/vmware specific serial numbers, virtualization drivers, etc) but exploits are hard, they are generally tied to a very specific version of very specific software in order to be successful, versions and products the author can't predict (are the hostile analysts running VMWare? Virtualbox? Xen? Mysteries...) and the target surface is likely very low since most malware is just going to be classified by some overworked junior analyst at an antivirus as "GENERIC.W32.RAT" well before it gets any sort of in-depth analysis and binned. Ultimately you shouldn't worry about VM escapes by any malware you're likely to come across, they're an academic threat. Weirdly, as a side effect of the first point, simply installing the virtualbox & vmware drivers on your real actual machine can stop a small subset of malware because it thinks it's running virtualized and shuts down

SomeStupidPoint 9y ago
I don't know that I'd say VM escapes are an academic threat -- more that they're used for targeted attacks and not generic malware (usually). Xen, VMWare, and presumably the others seem to get about 1 escape a year that's a serious vulnerability (and 2-3 other ones that could potentially be, but don't seem easily exploitable). Of course, that's publicly disclosed ones, which means there may be more that we're unaware of.

empath75 9y ago

There have been vm escape vulnerabilities published in the past (although none have been exploited that I know of.) http://venom.crowdstrike.com/ http://venom.crowdstrike.com/

j_s 9y ago
Depends on your definition of exploited; definitely nothing WannaCry-style yet! https://www.google.com/#q=Pwn2Own+2017+VM+escape https://www.google.com/#q=Pwn2Own+2017+VM+escape Virtual machine escape fetches $105,000 at Pwn2Own hacking contest | https://arstechnica.com/security/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/ https://arstechnica.com/security/2017/03/hack-that-escapes-v... "We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine," Qihoo 360 Executive Director Zheng Zheng wrote in an e-mail. "Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website." http://www.vmware.com/security/advisories/VMSA-2017-0006.html http://www.vmware.com/security/advisories/VMSA-2017-0006.htm... -- All that given up for only fame + ~$100k!

Dolores12 9y ago

Get cheap baremetal cloud server. Pay hourly. Avoid all risks.(at expense of cloud server provider :)

toomuchtodo 9y ago
I wonder if there's a need for a malware tear down service; submit a JSON request with the binary defined as part of the request, a spot instance spins up, allows the malware to run, and then all of the MITM network traffic and the instance memory snapshot is dropped into S3 for forensic exploration and collaboration. Forensic malware analysis as a service.
- Kalium 9y ago
  That's a very interesting idea! Certainly it's an interesting take on the sandbox, and might allow for access to analysis tools even for those without the required tools or skillset. Malware is a threat to us all, and anything offering to democratize analysis is well worth considering. With that said, I can perhaps see a couple of potential sources of additional complexity. First, a spot instance can't really offer the required level of sandboxing. A typical analysis scenario exploits the privileged position a VM host has over the guest to further analysis and safety. Attempting to do so from a peer position is more difficult and may put you in a more limited position to observe all potential behavior as you lose the ability to easily fake DNS, alter the clock, and more. Second, it's possible that cloud hosting service providers might run services designed to look for and shut down malware-infected hosts. It would certainly be in their general interest and probably in the general interest of most of their customers. In such a scenario, it's very possible that a service like that you describe might find all analysis attempts shut down instantly rather that be able to even attempt to gather useful behavioral evidence. Your idea is great! It's well worth exploring and holds amazing potential. It may perhaps be best done with the above caveats in mind.
  - toomuchtodo 9y ago
    Thank you! I'll explore the use of ephemeral VPCs for this tonight; that should allow for the level of network isolation (and possibly traffic routing through another VPC with network traffic inspection tooling) necessary.

celticninja 9y ago

As we saw with the recent Ransomware attack malware doesn't behave differently if it realises it is in a sandbox, however to date that has usually been to deactivate itself to reduce the likelihood of it being analysed. I imagine a virtualbox 0 day would be useful in these situations but probably only to state level actors or malware authors looking to get one up on security firms.

phaus 9y ago

Using a VM is the standard way to analyze malware. There is a threat, but its not considered to be significant at this point. If you were analyzing a malware sample that you knew for a fact performed VM escape, you would run it in a VM on a system specifically designated for that purpose. There are lots of ways that malware can detect the presence of a virtual environment, but part of reverse engineering malware involves defeating these mechanisms. Here's just a few simple ways that malware can detect the presence of a VM: - Size of the hard drive. (people frequently use smaller amounts of storage space for virtual environments). - Presence of a debugger. - Scanning for common analysis tools (regshot, process monitor, ollydbg, etc. - Processes associated with VMware - Network connectivity (like we recently observed) If anyone's interested in learning malware analysis, practical malware analysis is a great book for someone that's already decent at programming. I'd also recommend learning assembly pretty well before you get started.

tjoff 9y ago

About 20% between 2012 and 2014 [1], I actually believe it was much more earlier when few used VMs for production. That meant that a virus could assume that if it were executing in a VM context they were being monitored and altered their behavior to either play nice or distract. Nowadays a VM target could be just as valuable as any other. [1] https://www.symantec.com/connect/blogs/does-malware-still-detect-virtual-machines https://www.symantec.com/connect/blogs/does-malware-still-de...

alexchantavy 9y ago

> Is there any malware that detects that it's running under something like VirtualBox and changes is behaviour? Yup, see Blue Pill/Red Pill (https://stackoverflow.com/questions/154163/detect-virtualized-os-from-an-application https://stackoverflow.com/questions/154163/detect-virtualize...).