Hot answers tagged virtualization
22
The host machine can impact and alter whatever it wishes in the guest VM. The host can read and write all the memory of the guest, stop and restart it on a per-instruction basis, and, by nature, sees every single data byte which enters or exits the guest. There is nothing which the OS in a guest VM can do to protect itself against an hostile host.
Thus, if ...
21
There is no simple answer to this question. VM software is still software and has vulnerabilities that can be targeted and thus, in theory at least, exploited to do more harm.
Running an infected VM with access to your network also opens up potential attack vectors.
Another interesting point to consider is that sufficiently advanced malware could be ...
20
VM's can definitely cross over. Usually you have them networked, so any malware with a network component (i.e. worms) will propagate to wherever their addressing/routing allows them to. Regular viruses tend to only operate in usermode, so while they couldn't communicate overtly, they could still set up a covert channel. If you are sharing CPU's, a busy ...
16
There have been some white-papers published over the years describing ways that researchers have managed to infest a host OS from a VM. These are usually seen, rightly so, as security vulnerabilities by the VM vendors and treated as such. Since I first saw those papers, Intel has made some significant processor instruction-set improvements in allowing ...
16
Firstly, there is no guarantee you'll even be able to run a VM inside a VM. It may seem obvious but it is by no means certain it will even work. This is because VM's may rely on virtualization features of your hardware which are not exposed inside the VM itself.
Secondly, why two, why not three, four, five, etc... There is such a thing as overkill security. ...
15
Tor does not always protect your ip fully when you need to interact with the end node. You can check your efforts with online checks like this.
What has worked for me on every check I've tried is JanusVM. It runs as a VM, which you use as a proxy for your hardened browser VM. Janus uses Tor, squid, dns-proxy-tor, and privoxy to cover your ip. It is very ...
11
Theoretically, the guest system is totally isolated by the VM and cannot even "see" the host, let alone attack it; so the guest cannot break out of the VM. Of course, in practice, it has occasionally happened. An attack requires exploiting a security issue (i.e. a programming bug which turns out to have nasty consequences) in the VM implementation or, ...
11
Disclaimer: I'm going for a relatively high-level understanding. If you want a detailed guide, that's out of scope. Additionally, there are other ways (entirely in software) to implement virtual machines to which this does not apply. I am also focusing on "breaking out" through the virtualisation mechanisms only - i.e. not ones that can happen PC-to-PC on ...
11
I have not yet seen any in-the-wild malware that was designed to infect a host machine from within a VM. I expect that most malware simply wouldn't care whether it is running on the bare hardware or within a VM since it can achieve its goals equally well in both cases. It's probably safe to assume that malware won't escape a VM simply because it has no ...
11
Using a virtual machine is a safer way to study malware than running it on a normal machine - the main reason being that you can wipe and start over from a known fresh image at any time.
Isolation is also key, though - if your virtual machines are connected to your network they will be able to spread malware just as if they were physical machines, so either ...
10
Xen, by definition, is virtualized. It assumes a specific guest code for the operating system kernel. It does not try to hide the presence of virtualization, it actually advertises it plainly. This is not the VM you are looking for.
A fully invisible hypervisor is theoretically feasible, but not cheap. The problem is with timing. An hypervisor works by ...
9
You should use a live cd like BackTrack. This comes with TOR and software for breaking WEP and WPA2-PSK. Then you can go war driving... are you old enough to drive?
Also brush up on your OSI model, the MAC address is only needed by the data link layer and is there for scrubbed off by whatever router you are behind. However, some routers log what MAC ...
9
If you're running a VM and it isn't filtered by the firewall, then it's probably operating in a bridged mode at L2 below the firewall's view of packets. To diagram:
network card --|-- firewall ---- applications
|
VM
If you're talking about Linux, then a Serverfault question discusses this as well, and there are kernel ...
8
Legalities and ethics aside, the following could theoretically provide a reasonable level of anonymity:
A Live CD, e.g. one of the Linux variants
An internet connection not owned or traceable to you, e.g. an unsecured WiFi connection
An SSL VPN with an exit point in a country with laws to protect your information and purchased anonymously e.g. by mail ...
8
If you're looking for top-notch security of the highest kind - air gapping is the only way to make this work. Unfortunately, having absolutely no connections to the outside world under any circumstances can be prohibitive, especially as developers like to copy and paste code snippets from documentation and so on.
Ultimately, this probably also means taking ...
7
First of all, I assume that you have already located the IP address of the attacker, using an IDS for example. In this case:
Are there ways to determine that the attacker is using a VM at all?
One way I can think of, provided you have the IP, is to find the MAC of the attacker. Usually it will point to the manufacturer, which will be vmware or some ...
7
You don't say why you would care whether the attacker is using a VM. I'd say it is irrelevant. It's just a distraction. So I'd unask that part of the question.
As for how to tell what machine on the network is the host system, your ability to do this in this special situation is about as good as the situation when there is no VM. You have DHCP and ARP ...
7
It really depends.
To go through your points:
Depending on the host and guest operating systems, you may need additional security here. For example, I have a couple of Windows VMs from which I can remove any dodgy programs onto the samba share without too much fear that the linux host will be infected by the presence of these files. However, there is the ...
7
Simple answer is yes. If an attacker controls the hypervisor they can potentially get access to everything within it, including the memory space of a VM (which could include keys)
Worst case is to assume all may be lost if the hypervisor is compromised, so in order to prevent this, a well structured, layered security architecture may make it incredibly ...
7
Yes, if you strictly bond yourself to some (absolutely sane) security rules:
Use a completely different operating system for the host and for the guest. For example, malwares which will infect your Windows guest are unlikely to infect or even attack your Linux host.
Do not use similar operating systems on your network than the guest. Again, your Windows ...
7
Everything:
As root, just do this:
rm /dev/random
mknod /dev/random c 1 9
Now /dev/random will actually access the same underlying logic as /dev/urandom.
After this change, both /dev/random and /dev/urandom will draw from the non-blocking pool. The non-blocking pool will draw from the blocking pool, which the system will still fill.
7
Answer first, then why: A virtual machine can be more secure.
From a practical standpoint, there exists code and malware that can infect both boot partitions, BIOS, and also hardware devices. So, a VM has slightly more advantages in a reduced attack surface from a generic point of view - potential VM hopping code is the largest one specific to the VM. ...
7
The short answer is: No, this would not be an ideal or foolproof way to study a virus.
If the virus is designed to break out of the VM, there is no reason to believe it would stop at doing that once. For all you know, it might test whether it is run inside a second VM and break out of that one, too. That does not require much more sophistication than ...
6
Trusted Execution Technology is coupled with a collection of security features available on the modern Intel chipset. The Trusted Platform Module (TPM) and other DRM like features are also in this bundle. The reasoning behind this is because of abstraction, which is more commonly attributed to a software architecture. The commonality behind all of these ...
6
An example of guest-to-host code execution can be found in the Cloudburst exploit. There is a video demonstrating it and a paper from Immunity detailing their success on VMware Workstation 6.5.0 build118166 on a Windows Vista SP1, VMware Workstation 6.5.1 build126130 on a Windows Vista SP1, and (even more scary) VMware ESX Server 4.0.0 build133495.
This ...
6
I have done quite a bit of malware experimentation within a VM - mostly using backtrack4 to break in from one host to the next. I'm a VMware Workstation user, primarily.
The largest issue comes from the possibility of the network connection of your VM transferring back to your host OS. You want to totally disable networking and / or use a network which has ...
6
It would be quite useless to install them at the same time because they will interfere with eachother. Most of the firewall and AV software have components you can't always shut off.
It is better to make a virtual machine you want to test on, clone this VM and then install other AV/firewall software on everyone of them. Then you can do different tests and ...
6
Now we have the info we needed.
Because you are running the scan from within a VM on MachineA, scanning the VMs on MachineB and MachineC and doing it in bridged mode, you ARE going to get odd responses. The host machines are going to make subtle changes to the traffic because the hosts are acting a little like routers. If you have firewalls on the hosts, ...
6
To quote the Intel Software Manual, Volume 3c:
VMXON is also controlled by the IA32_FEATURE_CONTROL MSR (MSR address 3AH).
This MSR is cleared to zero when a logical processor is reset. The relevant bits of the
MSR are:
Bit 0 is the lock bit. If this bit is clear, VMXON causes a general-protection exception. If the lock bit is set, WRMSR to ...
6
The implementation of the virtual machine is a kernel for the kernel.
In a typical operating system, there is application code (aka "userland") and kernel code. They use the same set of instructions; however, the CPU knows, at any time, whether it is executing application or kernel code. When application code tries to execute some opcodes which access the ...
Only top voted, non community-wiki answers of a minimum length are eligible
