5 ms·

Yea, this part was confusing to me as well. How would a VM "simulate" the internet? Does it return a dummy page? I don't understand what mental model of VM beha

• javajosh 9y ago
  The part about how to simulate a site isn't confusing, the part about why you'd want to do that is the confusing part. If I was researching malware in a VM I'd want to take a very passive approach, and allow it to talk to the real internet, and inspect the traffic.
  • LolWolf 9y ago
    It does do that, but in order for it to inspect what's going on, the VM has to accept an outgoing connection as legitimate.
• imtringued 9y ago
  By intercepting every DNS request and routing it to your honey pot server which logs the packets the malware sends to the mothership. What the malware author should do is simply randomly generate the DNS name at the cost of the unlikely chance of hitting a valid domain name instead of hardcoding it.