Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We want to study for the CEH program and have downloaded 12 DVDs that 6 DVDs are software key-loggers, Trojans, etc. that are all detected by antivirus. This prevents us from examining them and learning how they work.

I have instructed students not to uninstall antivirus as running these malicious files is not safe on its own. It might even spread on the network.

One of the students suggests to use Windows XP mode. Is this safe? I see these articles 1 and 2 here but the answers are contradictory and confuse us.

Are virtual machines safe for downloading and installing Trojans, key-loggers, etc.?

Is there another way to solve this problems, e.g. set up a lab, to show what happens to victims of the malware?

share|improve this question
1  
Are these known forms of malware? I.e. do you know what kind of threat they pose (by using a virus encyclopedia) or may they perform unknown actions? Of course, it is never safe to make too many assumptions on their respective threats, but, for example, if you obtained them from an anti-virus company for scientific purposes their behaviour in virtual machines may be known to the extent where you can decide if it is too much of a risk to run them in a virtual machine. –  Legolas Nov 2 '12 at 7:35
add comment

6 Answers

up vote 6 down vote accepted

Are virtual machines safe for this? The answer is the same as for a lot of questions of the form "Is X safe?": no, it's not absolutely safe.

As described elsewhere, bugs in the virtual machine or poor configuration can sometimes enable the malware to escape. So, at least in principle, sophisticated malware might potentially be able to detect that it's running in a VM and (if your VM has a vulnerability or a poor configuration) exploit the vulnerability or misconfiguration to escape from your VM.

Nonetheless, it's pretty good. Probably most malware that you run across in the field won't have special code to escape from a VM.

And running the malware in a VM is certainly a lot safer than installing it directly onto your everyday work machine!

Probably the biggest issue with analyzing malware samples in a VM is that some malware authors are starting to get smart and are writing their malware so that it can detect when it is run in a VM and shut down when running inside a VM. That means that you won't be able to analyze the malicious behavior, because it won't behave malicious when it's run inside a VM.

What alternatives are there? You could set up a sacrificial machine on a local machine, install the malware on there, then wipe it clean. Such a test network must be set up extremely carefully, to ensure that the malware can't propagate, can't spread to other machines of yours, and can't do any harm to others.

References:

share|improve this answer
    
if i add question here :(IT Security) and ask : which technology is safest and have a highest security? what is your opinion? is this good question ? –  saber tabatabaee yazdi Nov 7 '12 at 7:55
add comment

Using a virtual machine is a safer way to study malware than running it on a normal machine - the main reason being that you can wipe and start over from a known fresh image at any time.

Isolation is also key, though - if your virtual machines are connected to your network they will be able to spread malware just as if they were physical machines, so either isolate logically (within the host) or physically (disconnect from the network)

share|improve this answer
    
please comment for whos say: "VM is not safe". –  saber tabatabaee yazdi Nov 7 '12 at 7:48
1  
@saber? I have no idea what that comment means - please explain. –  Rory Alsop Nov 7 '12 at 9:16
    
another answers others say : "VM is not safe" please comment on their answer, and comment your reason and want them to write their reasons. –  saber tabatabaee yazdi Nov 7 '12 at 9:29
1  
It is relatively safe, however there is no such thing as 'safe' which is why I have written the answer above. –  Rory Alsop Nov 7 '12 at 9:31
1  
Questions like that aren't answerable. What you really need to do is look at your specific requirements and ask "how to secure that environment/application/scenario" because all technologies have pros and cons - you always have to consider the usability/risk tradeoff in every security decision –  Rory Alsop Nov 7 '12 at 10:19
show 1 more comment

I wouldn't try messing around with "XP mode" as a method of isolating malware. A virtual machine is your best bet. The guest OS will be isolated from the host system, so it'll install onto the VM and do its nasty stuff, and you can just revert it back to a clean snapshot when you're done.

share|improve this answer
1  
Looking at the links, I think that OP really wants to know if virtual machines are safe to use examining malware. –  Henning Klevjer Nov 1 '12 at 6:54
add comment

I've seen enough tangential information to believe that some viruses are capable these days of detecting that they are on a virtual machine and alter their behavior accordingly. The example I've heard is that the code will appear benign in the VM and then reactivate and infiltrate when not in a VM.

My recommendation whenever you want to test malware is to play in a cleanroom with disposable equipment. Don't trust the VM to be your barrier - run in a lab where any network you provide is entirely standalone, connected to nothing else. Be sure that any removable memory (USBs, etc) you use is one way only from the outside world in, and when you're done, wipe and reimage the computers you used for testing. Bring everything back to a known good state, don't try to clean up manually.

For the purpose of study, it would probably be quite a lot of fun to try the viruses on both a machine with a vM and a regular bare bones host. I'd probably throw some network monitoring on there, too, to see what the software tries to do over the network.

share|improve this answer
    
your answer is helpful for me but other answer seems to be better or has more information thanks a lot. –  saber tabatabaee yazdi Nov 5 '12 at 8:05
add comment

I think we don't have to be more clever as really good professinals are. Mark Russinovich usually use virtual machines to analyze a code behaviour. Of course this doesn't mean that you don't have to be careful, isolate the virtual machine as far as possible (firewall settings and so on).

share|improve this answer
add comment

To add to the wonderful answers given by others, and to add my own experience to it-

No virtual machines are not 'safe' for your purpose, as has been already elaborated by @bethlakshmi.
I also do some kind of security-related experiments, and so I requested my authorities to give me a separate LAN which is disconnected from the rest of the network at my University.

What I ended up getting was a VLAN which is disconnected from the rest of our network- and I do all my experiments on virtual machines in that network (which, again, is not the best option - A simple search on this site will reveal to you that VLANs are not really a 'security' - see here). So your best bet seems to be to either have a network which is disconnected from the rest of your network, or simply not connect the VMs to a network and keep them isolated.

Adding to the comment by @Legolas -
And surely stay away from any stuff coming from/endorsed by the black hat community. For my context I can tell of one tool called Havij- not sure of things in your context. When you are dealing with malwares and stuff like that, you never what all it will do apart from what it claims to do!

share|improve this answer
    
but Learning DVDs that teach Virtualization Claimed that VLAN CREATE ISOLATED NETWROKS !!! if i asked my question again and says that my virtualization is ESXi5 , are answers are substituted? (changed?) –  saber tabatabaee yazdi Nov 5 '12 at 8:10
    
can't comment on that... my knowledge is limited to the question I linked. –  pnp Nov 7 '12 at 5:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.