Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer.

Can I install the malware in a VMWare VM, maybe even without network access, without risking the integrity of my host system?

share|improve this question
3  
    
Thanks a lot for the extensive answers! –  Erik Mar 9 '12 at 19:16
    
There is also a related question on SuperUser: Is my host machine completely isolated from a virus-infected virtual machine? –  Diogo Mar 12 '12 at 17:53
add comment

5 Answers

VM and a debugger is the best non-professional option you have.
AV companies usualy use a sandbox to analyze the behavior. If you search you will find applications like this.

share|improve this answer
add comment

I have not yet seen any in-the-wild malware that was designed to infect a host machine from within a VM. I expect that most malware simply wouldn't care whether it is running on the bare hardware or within a VM since it can achieve its goals equally well in both cases. It's probably safe to assume that malware won't escape a VM simply because it has no incentive to do so.

There are tools designed for containing and analysing malware and lots of information available on how to do this. Also a couple of papers with techniques and tools.

share|improve this answer
12  
There is malware that will change its behavior if it detects it is being run from a VM. Currently, this is not known to be used to escape the VM. Rather, it is used to thwart attempts at analysis by researchers who would use the VMs for that purpose. @code_burgar has addressed this some. –  Iszi Mar 9 '12 at 13:47
    
    
You don't see any benefit from being able to escape from a VM and infect the host OS? Considering that many people are using VMs to browse unsafe sites on their main machines, and the VMs don't have sensitive information but the hosts do? One step more evil, my friend... –  devnul3 Mar 9 '12 at 16:10
    
@devnul3 You seem to have missed the "in-the-wild" qualifier at the start of my answer. I know it's possible to escape a VM and I can certainly think of reasons malware might want to, but most malware is concerned with other things such as sending spam and stealing credit card numbers. I do think we'll see more malware in the future that does care, however. As Iszi said, malware authors care about malware analysers. –  Ladadadada Mar 9 '12 at 16:22
    
@Ladadadada My point (which granted I didn't explicitly state...) was that I have seen malware in the wild based on that prototype, rather a lot of it in fact. It's very subtle, but it very definitely exists. Apparently, YMMV... –  devnul3 Mar 12 '12 at 7:19
add comment

The only possible way might be exploiting a bug within the VM software because everything the VM does is catching events like I/O and hand it over to the host machine. If your vendor didn't take care about bufferoverflows here and there, you probably could execute hazardous code on the host machine. BUT! I'm actually not 100% sure.

share|improve this answer
    
Solid points, the question is really about experience though, not so much about the theory –  devnul3 Mar 12 '12 at 7:22
add comment

There is no simple answer to this question. VM software is still software and has vulnerabilities that can be targeted and thus, in theory at least, exploited to do more harm.

Running an infected VM with access to your network also opens up potential attack vectors.

Another interesting point to consider is that sufficiently advanced malware could be VM-aware and modify it's behavior when it detects that it's running inside a VM, masking the actual harm-causing capabilites.

share|improve this answer
4  
For known (or at least not-unknown) malware that you can guarantee is not VM-aware, a VM is probably the safest and most flexible way to investigate it. –  pdubs Mar 9 '12 at 14:04
    
@pdubs not-unknown...great, add that to the list of known, known unknown, unknown unknown... –  Ben Brocka Mar 9 '12 at 15:34
    
True, virt-what as an example that it is indeed possible to detect VMs. Specific behavior is just the next logical step. –  ordag Mar 9 '12 at 16:31
    
@BenBrocka I was thinking that a "not-unknown" malware would be something like "new Vundo variant", where it would be reasonable to assume that a VM-aware component has not been added. It's a situation where you know what it does, but not how it does it. –  pdubs Mar 9 '12 at 16:44
add comment

Yes, if you strictly bond yourself to some (absolutely sane) security rules:

  1. Use a completely different operating system for the host and for the guest. For example, malwares which will infect your Windows guest are unlikely to infect or even attack your Linux host.

  2. Do not use similar operating systems on your network than the guest. Again, your Windows guest could be infected, but an OpenBSD is highly unlikely to be attacked by any malware.

  3. Use common sense. The goal of the virtualized system should be entirely to be infected. Do not use the infected system, for example, to your online banking operations.

  4. Know your limits. This is extremely important. Whenever it is suspicious that other malware appeared on your system than the specific malware under investigation, immediately finish your experiment, and start over.

The first two points of the list will - certainly - almost guarantee that a security flaw in your virtualization system wouldn't harm your other machines.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.