6 ms·
If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse
by ttul 1y ago
If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.
- ronsor 1y agoPut VirtualBox strings in your firmware :)
- tripplyons 1y agoYes, and don't forget to install the VirtualBox guest extensions in your host machine to make it looks even more like a VM!
- thrtythreeforty 1y agoIs there any downside to unironically doing this? Seems like it'd actually work.
- DelaneyM 1y agoIt’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.
- ronsor 1y agoPlease tell me what tools you use to receive future zero-day vulnerability patches.
- ofjcihen 1y agoTo be fair the vast, vast majority of exploitation that we see (especially in the news) comes from sub-par security setups and poor training/architecture. That’s no even going into security monitoring which most companies don’t or barely have. Zero days account for very small amount of exploitation in comparison and by definition are unpatched so I think the commenter was right to point out the basics.
- fsflover 1y agoQubes OS should protect you even from unknown vulnerabilities as long as you use its compartmentalization approach. Works for me (or so I hope).
- danielschreber 1y agoWikipedia's page on "just intonation" is, oddly, about music.
- andybak 1y agoOK. You've lost me.
- danielschreber 1y agoI apologize for making you feel dumb. Just try practicing some mindfulness.
- cwmoore 1y agoAnd it is so too that “just deserts” are rarely desserts at all.
- Bluestein 1y ago... as is "Just for Men"
- Melatonic 1y agoAgreed - like using a non admin account.
- anonymars 1y agoHow does that protect against ransomware?
- petersellers 1y agoLimits the blast radius to only the files that the more limited user has write access to.
- deleted 1y ago[deleted]
- azov 1y agoThe files I normally have write access to are my important files though. Immutable snapshots/offline backups help with those.
- mr_mitm 1y agoIt's more important in a corporate setting. Lateral movement inside the network is much more likely if the attacker has local admin.
- anonymars 1y agoWhy would local admin have relevance to network movement?
- dpoloncsak 1y agoAs with the other reasons stated... local admin, atleast in the environments I've seen, can still install software. Installing and running something like AngryIPScanner may be possible as local admin
- anonymars 1y agoDefense in depth
- chii 1y ago> It’s not much harder to just harden your system 'just' harden the system is not easy. But installing something like a vmware guest driver is easy, as even a non-technical user can do it following some basic instructions.
- akersten 1y agoAnticheat might throw a fit
- zaphirplane 1y agoThere is an oracle license attached to it
- waste_monk 1y agoIIRC the extensions pack has a (very limited) free license for personal and educational use, although I'm not sure if the 'pretending to be a sandbox' usecase would be covered.
- adastra22 1y agoExpect Oracles lawyers to send you a bill.
- general1726 1y agoTime to install Ghidra on every station
- rzzzt 1y agoIt was mentioned in the other front page article, I guess this is where we got this submission from: https://news.ycombinator.com/item?id=44413185 https://news.ycombinator.com/item?id=44413185
- Melatonic 1y agoMost windows servers are virtualised these days so I'm not sure this would work anymore. It might look at other indicators though
- loktarogar 1y agoThere's other tells, like this other top HN post right now tries to work around: https://wbenny.github.io/2025/06/29/i-made-my-vm-think-it-has-a-cpu-fan.html https://wbenny.github.io/2025/06/29/i-made-my-vm-think-it-ha...
- thaumasiotes 1y ago> If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game. What? This is an entirely separate concern. If you have a Russian input method installed, malware will terminate to avoid legal repercussions.
- lcnPylGDnU4H9OF 1y agoThey seem to be offering this as another means of getting the malware not to run. I don't read it strictly as an explanation of the Russian keyboard thing.
- mrkramer 1y agoYea sophisticated malware checks how many CPU cores PC has, how much hard drive space, some even check hardware temperature or if any debuggers are present. Windows malware got pretty sophisticated in the last 30 years.
- wiz21c 1y agoany good read on how good they are nowadays ? (my background is cracking games 35 years ago :-))
- mrkramer 1y agoI'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://research.checkpoint.com/ https://blog.talosintelligence.com/ https://blog.talosintelligence.com/ https://www.welivesecurity.com/en/ https://www.welivesecurity.com/en/ Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/ https://www.microsoft.com/en-us/security/blog/ Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques. Here is for example good compilation of malware's anti-debugging and anti-VM techniques: https://anti-debug.checkpoint.com/ https://anti-debug.checkpoint.com/ https://github.com/CheckPointSW/Evasions https://github.com/CheckPointSW/Evasions
- tackypenguin 1y agoMalware targeting Macs is booming, and, IMO, the most interesting malware targets iOS. https://taomm.org/ https://taomm.org/ https://citizenlab.ca/ https://citizenlab.ca/ https://objective-see.org/blog.html https://objective-see.org/blog.html
- tempodox 1y agoAny tutorials on how to do that?