3 ms·

this is unbelievably malicious! In our earlier discussion there was some discussion about the installer asking for permission to install crapware. in fact if y

this is unbelievably malicious! In our earlier discussion there was some discussion about the installer asking for permission to install crapware. in fact if you're going to do malware stuff like this, why even ask? On a technical level - how come you can detect VM's? with something like BOCHS and if you lie about wall time inside your OS, can't it emulate a PC perfectly? How does crapware know whether it's in a VM or not?

stephengillie 11y ago
Well, there are a couple things - For one, the hypervisor presents different "hardware" than you would get in a standard HP or Dell box. And often the hypervisor has a driver package to install, to facilitate communication between the OS and hypervisor - this is used mostly to manage memory overcommit with things like a memory bubble. As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.
jaysh 11y ago
This is a nice article on the matter: http://web.archive.org/web/20110929075510/http://invisiblethings.org/papers/redpill.html http://web.archive.org/web/20110929075510/http://invisibleth.... It doesn't appear to work reliably anymore, but the principle is the same. Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.
MiddleEndian 11y ago
>in fact if you're going to do malware stuff like this, why even ask? Just a guess, but probably plausible deniability reasons for when they're inevitably brought to court.
- throwaway498982 11y ago
  there is no plausable deniability if it does something different in a VM. that takes active coding to set up, there is no reason anyone would ever have any code that has this effect.
  - wernercd 11y ago
    There are PLENTY of reasons to code your application to act differently based on environment... while many of them may be bad, not all of them are. Some abuse this to make speed tools run faster, ala Graphic Card tests that run faster when it detects NVidia/AMD... some abuse it to skirt protections in VMs... Do we need to ban torrents because a lot of torrents are illicit materials? Ban bitcoins, because some people use it for drugs? Ban tor?
  - MiddleEndian 11y ago
    I was only referring to the "why even ask?" part of your post. They most likely ask during the installation for liability purposes. VM behavior or not, asking or not, I've hoped they get in legal trouble for this as soon as I knew about it, but of course, IANAL.
toyg 11y ago
Well, on a Windows VM in VMWare products, you can just ask the OS and it will happily report the manufacturer as "VMWare, Inc" for example. I would expect other virtualizers to do something similar, if not there in some other places (like drivers etc).
theandrewbailey 11y ago
I've heard that it's mostly searching for VM addon software used in VMs, like VirutalBox Guest Additions.
mikeash 11y ago
You can emulate a PC perfectly. But in practice there's a tradeoff between perfect emulation and performance, and since a VM's goal is typically to run cooperative software quickly, they aim for performance. For example, for best performance you want to run the instructions in the VM directly on the hardware CPU so that they run as fast as they would outside the VM. But not all instructions can be run safely this way, so the VM will trap some and emulate them. This is necessarily slower, so a program can detect the presence of a VM by noticing that some instructions are much slower than they ought to be. You can lie about the time, but the bookkeeping needed to do so accurately imposes a lot of overhead.

stephengillie 11y ago

Well, there are a couple things - For one, the hypervisor presents different "hardware" than you would get in a standard HP or Dell box. And often the hypervisor has a driver package to install, to facilitate communication between the OS and hypervisor - this is used mostly to manage memory overcommit with things like a memory bubble. As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.

jaysh 11y ago

This is a nice article on the matter: http://web.archive.org/web/20110929075510/http://invisiblethings.org/papers/redpill.html http://web.archive.org/web/20110929075510/http://invisibleth.... It doesn't appear to work reliably anymore, but the principle is the same. Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.

MiddleEndian 11y ago

>in fact if you're going to do malware stuff like this, why even ask? Just a guess, but probably plausible deniability reasons for when they're inevitably brought to court.

throwaway498982 11y ago
there is no plausable deniability if it does something different in a VM. that takes active coding to set up, there is no reason anyone would ever have any code that has this effect.
- wernercd 11y ago
  There are PLENTY of reasons to code your application to act differently based on environment... while many of them may be bad, not all of them are. Some abuse this to make speed tools run faster, ala Graphic Card tests that run faster when it detects NVidia/AMD... some abuse it to skirt protections in VMs... Do we need to ban torrents because a lot of torrents are illicit materials? Ban bitcoins, because some people use it for drugs? Ban tor?
- MiddleEndian 11y ago
  I was only referring to the "why even ask?" part of your post. They most likely ask during the installation for liability purposes. VM behavior or not, asking or not, I've hoped they get in legal trouble for this as soon as I knew about it, but of course, IANAL.

toyg 11y ago

Well, on a Windows VM in VMWare products, you can just ask the OS and it will happily report the manufacturer as "VMWare, Inc" for example. I would expect other virtualizers to do something similar, if not there in some other places (like drivers etc).

theandrewbailey 11y ago

I've heard that it's mostly searching for VM addon software used in VMs, like VirutalBox Guest Additions.

mikeash 11y ago

You can emulate a PC perfectly. But in practice there's a tradeoff between perfect emulation and performance, and since a VM's goal is typically to run cooperative software quickly, they aim for performance. For example, for best performance you want to run the instructions in the VM directly on the hardware CPU so that they run as fast as they would outside the VM. But not all instructions can be run safely this way, so the VM will trap some and emulate them. This is necessarily slower, so a program can detect the presence of a VM by noticing that some instructions are much slower than they ought to be. You can lie about the time, but the bookkeeping needed to do so accurately imposes a lot of overhead.