6

I often test malware in QEMU VMs, and after I have tested some malware in a VM, I delete the VM for security reasons as well as the fact that if I want to test more malware, a clean environment to start with would be preferred.

However installing a new OS in a VM takes quite some time, especially Ubuntu and Fedora, so an easier option would just be to boot directly from the ISO and use a live session for one of those OSs.

But I would like to know, is running a live session from an ISO where data may be written back to it and kept there less secure than installing it properly to a Virtual Hard Disk? Is there actually any difference? Is the live session at all less secure than a proper one? Or are they the same and equally safe for malware testing?

My host is Arch Linux.

Improve this question
2
  • I thought you couldn't write data back to a live session? But also, why not just copy/snapshot the VM after installing the OS and before installing the malware? – user253751 Mar 22 '17 at 21:06
  • @immibis: Seemingly you can with some. Also, that is a good idea! For some reason I hadn't thought of that! – user67447 Mar 23 '17 at 20:43
3

Testing from a "live" session VM might be slightly more secure, but considerably less thorough.

Live sessions use a RAM-based file system like SquashFS, aufs or UnionFS to simulate write access to the primary partition. Malware can propagate by writing worms into the master boot record of the volume, which can be simulated (and scrutinized) from a qcow volume or raw disk image, but is completely absent in an ISO-9660 optical filesystem.

If I were you I would consider making a "starter" images of vanilla Ubuntu / Fedora, then make copies of those to test your malware.

If you're extra paranoid that the malware might "break out" of its VM, you could make sure you are running QEMU as an unprivileged user.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy