3 ms·
I’ve had a really hard time finding good guides for hardening VMs for malware analysis or processing untrusted inputs as you suggest - any guidance on learning
by wswope 5y ago
I’ve had a really hard time finding good guides for hardening VMs for malware analysis or processing untrusted inputs as you suggest - any guidance on learning resources?
- djbusby 5y agoI learned the hard way. But for these restricted jails I'd start by making a VM that is not allowed out at all, like DROP on iptavles OUTPUT chain.
- yjftsjthsd-h 5y agoAt that point, why not just boot the virtual machine with no network interface attached?
- jcpham2 5y agoMalware anti detection: some will not launch without a network connection. The idea is to simulate a functional network but not provide access.
- djbusby 5y agoYea, the VM has a network so it looks "real" and I'm using the network interface to push the files to it (via SSH). Iptables let's related. And on the Host I'm also blocking/logging the VM network.