I keep seeing how people are working to make virtual machines look more like real machines, but I have been wondering about the reverse. I have noticed a trend where viruses will automatically shut off if they think that they are in a virtual machine. Using that train of thought, couldn't you attack this from both ends and make the virtual machine look more like the host and the host more like the guest?
Add a comment
|
3 Answers
Presumably you could, installing e.g. fake drivers that look like VirtualBox Guest Additions, or fabricating a PCI card that looks like virtio.
But malware authors check for these things because they are indicative of security researchers trying to sandbox the malware to reverse engineer it, or antivirus trying to sandbox the malware to test its behavior—but if their techniques no longer accurately detect VMs, or if they don't want to detect VMs anymore because valued infrastructure actually runs in them (e.g. cloud hosting), then they will no longer exit on these conditions.
I think, the answer to "how to make my host look like a virtual machine" is "run a virtual machine on your host".
(the other direction of making a VM look like it's not a VM is far more difficult and interesting)
What exactly does it mean to "fake" your host to look like a VM? It probably means a translation layer for your CPU instruction so that the application sees the CPU behave like a VirtualBox or VMmare CPUt. Wrap your hard drive drivers and other firmware to look like the VirtualBox or VMware drivers. Etc.
At some point this is no longer "faking" and you're actually just running a virtual machine.
answered Mar 17, 2021 at 19:01
Usually VM detection is based on two common techniques:
- checking the MAC address: Virtualbox MAC addresses would probably begin with 52:54:00 or another range assigned to Oracle. I don't have a complete list, but see for example: https://macaddress.io/faq/how-to-recognise-an-oracle-virtual-machine-by-its-mac-address.
- looking for the presence of specific DLLs or guest additions software
By leveraging either or both techniques you may be able to "spoof" a VM. The MAC address can be faked automatically by the system. There many ways of doing it, preferably it should be done before the malicious program is executed.
No guarantee this will fool programs 100% of the time as they may use other tricks to determine whether the machine is a VM or not.
