Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently came (Dunno, since when it was happening) to know that malwares can detect if they are running inside a VM like Vmware, and thus can change their behaviour.

So my question is how the security guys going to properly investigate a malwares behaviour, since running them in VM might not be a good idea anymore for those kinds of malwares ?

Running inside real machine (not VM), you might loose some inputs of that malware ?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The concept you're referring is to is called red pill detection.. The bad guys have gotten wise to the fact that the good guys can easily put a malware in a virtual sandbox to do dynamic analysis, so some are building in red pill action. For common hypervisors, doing a simple driver check will show whether the guest is running on vmware, xen, or other hypervisors.

This has little impact on forensics. Any good forensics investigator will have resources to do analysis outside a VM environment. Simply, using a VM guest (i.e. automation) to do malware analysis simplified forensics for the good guys. Not all malware does detection today. Considering the bad guys usually prefer to keep packages small, embedding additional functions like vm detection adds additional complexity to code. Such detection may only be present when the bad guys are really concerned about being detected. Since most malware packages target the lowest hanging fruit (which there are plenty of), additional features (i.e. encryption, vm detection, steganography, etc) really aren't necessary. So, existing models of automating forensics are still effective.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.