Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know nothing about VM's and all the stuff that happens behind-the-scenes when i connect to the internet. But, i did not expect this to be possible.

Can someone explain how it was possible for me to connect to the internet via VM ?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

It can very well be that your NIC of your VM is bridged to your physical machine, which means the firewall rules which apply to your physical machine, may not apply for your VM.

share|improve this answer
    
I am a newbie to computer science and electronics. So, its difficult for me to fully appreciate the answers i get. Can you give me a plain English description of your answer ? –  FirstName LastName Jan 19 '13 at 8:59
2  
Instead of getting internet through your host operating system your vm can directly access the network card in your machine. –  Lucas Kauffman Jan 19 '13 at 13:01
add comment

Nowadays malware is no longer trying to break your computer on purpose or play mean jokes on people. So it is very probable that malware changed your settings in order to intercept and maybe change your traffic. Those changes might have had bugs or maybe the authors stopped the entire operation like it was the case with DNSChanger. There are a couple of popular ways malware will interfere with your internet access:

  • Change DNS settings
  • Change proxy settings
  • Change routing settings
  • Change local router settings
  • Install malicious browser extensions
  • Intercept (hook) browser functions

A new OS in a virtual machine wouldn't be affected by most of these changes because it would be connected directly to the network. This mode is called bridged mode and the computer in the virtual machine acts like a new computer on the network. There is one other mode of connecting to the internet and it is called NAT mode where your host computer acts like a router for your virtual machine.

Here are resources where you can read more:

Friendly advice: Google will not provide exact answers to your questions but int time, you will learn how to find information and answer your own questions better than this website will.

share|improve this answer
    
Is there a way to find out which of the above methods or combinations of methods was used to stop my internet access ? –  FirstName LastName Jan 19 '13 at 22:18
    
Antivirus might detect a few methods but there is no automated way of doing it. You must have the knowledge to manually find the changes. –  Cristian Dobre Jan 20 '13 at 14:42
add comment

The way a computer "accesses Internet" is through a tower of systems, each using the one underneath. Schematically, it works like this:

  • An application, let's say Internet Explorer, decides to access a given URL, like http://www.example.com/. IE must first contend with its loadable modules: all the extra plugins which can be loaded into IE and may make arbitrary things with it. For now, I assume that no such plugin decided to do funky things. IE will access the URL.

  • This involves talking to the machine which has the name www.example.com but its proxy settings may instruct it to talk instead to a dedicated proxy machine, in which case IE will want to talk to the proxy machine. I assume here that there are no such proxy settings.

  • Since the Internet uses IP addresses, the name (www.example.com) must first be translated to an IP address. This is a matter of using the DNS. In practice, IE uses one of the system DLL, which itself may talk to other DLL or other process on the machine, depending on your OS and the local DNS configuration. Ultimately, one of these components needs to send packets to the outside world and receive responses:

    1. The request (an UDP packet) is wrapped into an IP packet; this is handled somewhere in the kernel.
    2. The local firewall rules are checked, to see if the packet is "allowed".
    3. The ARP cache is checked for knowledge of the MAC address of the next router (your home router, the modem provided by your ISP...). If not, some extra frames must be exchanged over the wire (or air, if using WiFi).
    4. All the frames to be sent and received go through the driver for the network interface which enacts the necessary magic. The driver is a software components loaded into the entrails of the OS (into the kernel, directly).
    5. The response (if any) will follow the same path in reverse: driver, firewall, unwrapping, UDP packet to the DNS handling process, then sent to the waiting Internet Explorer.
  • When IE obtains the (purported) IP address for www.example.com, it initiates a TCP connection to that server. This again uses a lot of IP packets which all go through the layers exposed above. Once the TCP connection is established, IE sends the HTTP request and expects the HTTP response, which involves more IP packets.

    The plugins may yet again interfere. If they do not, IE converts the received request into something which can be displayed to the user. The actual display goes through the window management and display driver of the operating system. Ultimately, the user "sees" the page.

An Internet-blocking malware can insert itself at any place in all this mechanism. The malware may be a loadable module in IE; it may alter the proxy settings; it may change the DNS configuration; it may disrupt transmission in the firewall settings; it may act as a pseudo-driver for the network interface; it may even fiddle with the display driver (some SSO do it to recognize password-entry popups, so malware can do it, too).

If you can access the Internet from your VM, then this means that the VM plugs itself at deeper layer than the malware. For instance, Virtualbox, when using "bridged networking", acts at the network interface driver level; it thus bypasses the upper layers (modules, proxy, DNS, firewall) and is unaffected by whatever the malware may have done to them.


Of course, the plausible scenario is not that the malware wanted to wantonly block your Internet; instead, it was probably trying to insert itself inconspicuously in the traffic, so as to promote its own nefarious schemes, like displaying ad popups or relaying spam. That your Internet is blocked probably means that the malware failed and broke the OS instead of leeching on it discreetly.

So you not only got infected by some malware; you got infected by some incompetent malware.

Usual recommendations apply nonetheless: save your data on a USB drive, nuke the machine (reformat, reinstall from scratch), install an antivirus/malware (e.g. the one from Microsoft), plug the USB drive, scan it with the antivirus, then finally copy back your data. This will take the better part of a week-end...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.