Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and hide their iframes for VM visitors ?

Edit: does browser attacks effect QEMU as well ?

share|improve this question

1 Answer 1

Yes...

Google VM detection and you will see that there are numerous ways to detect environment variable signatures that are giveaways to being inside of a VM. Most of these can be done from JS, some more difficultly than others, but still done. Bottom line, detecting you are running in a VM is really not too hard and whether you are running JS or not is not the issue.

Here is an article on exactly how one researcher showed you could using MAC address detection.

http://carnal0wnage.attackresearch.com/2009/04/detecting-vmware-with-javascript-or-how.html

share|improve this answer
    
is there any virtualization software (e.g QEMU) to prevent just a web page detect we are using virtualization? –  w00dy Mar 29 '13 at 10:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.