|
I recently came (Dunno, since when it was happening) to know that malwares can detect if they are running inside a VM like Vmware, and thus can change their behaviour. So my question is how the security guys going to properly investigate a malwares behaviour, since running them in VM might not be a good idea anymore for those kinds of malwares ? Running inside real machine (not VM), you might loose some inputs of that malware ? |
|||
|
|
|
The concept you're referring is to is called red pill detection.. The bad guys have gotten wise to the fact that the good guys can easily put a malware in a virtual sandbox to do dynamic analysis, so some are building in red pill action. For common hypervisors, doing a simple driver check will show whether the guest is running on vmware, xen, or other hypervisors. This has little impact on forensics. Any good forensics investigator will have resources to do analysis outside a VM environment. Simply, using a VM guest (i.e. automation) to do malware analysis simplified forensics for the good guys. Not all malware does detection today. Considering the bad guys usually prefer to keep packages small, embedding additional functions like vm detection adds additional complexity to code. Such detection may only be present when the bad guys are really concerned about being detected. Since most malware packages target the lowest hanging fruit (which there are plenty of), additional features (i.e. encryption, vm detection, steganography, etc) really aren't necessary. So, existing models of automating forensics are still effective. |
|||
|
|
