Is a QEMU live session less secure than a proper VM?

Question

I often test malware in QEMU VMs, and after I have tested some malware in a VM, I delete the VM for security reasons as well as the fact that if I want to test more malware, a clean environment to start with would be preferred.

However installing a new OS in a VM takes quite some time, especially Ubuntu and Fedora, so an easier option would just be to boot directly from the ISO and use a live session for one of those OSs.

But I would like to know, is running a live session from an ISO where data may be written back to it and kept there less secure than installing it properly to a Virtual Hard Disk? Is there actually any difference? Is the live session at all less secure than a proper one? Or are they the same and equally safe for malware testing?

My host is Arch Linux.

Answer 1

Testing from a "live" session VM might be slightly more secure, but considerably less thorough.

Live sessions use a RAM-based file system like SquashFS, aufs or UnionFS to simulate write access to the primary partition. Malware can propagate by writing worms into the master boot record of the volume, which can be simulated (and scrutinized) from a qcow volume or raw disk image, but is completely absent in an ISO-9660 optical filesystem.

If I were you I would consider making a "starter" images of vanilla Ubuntu / Fedora, then make copies of those to test your malware.

If you're extra paranoid that the malware might "break out" of its VM, you could make sure you are running QEMU as an unprivileged user.