1

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic devices come to monitor the network and know what happens in it.

Thinking of an alternative, it occurred to me that I could clone the current system and run it in virtualbox and sniff the network traffic of the virtual machine.

Could this be as effective as the electronic device for detecting backdoors or programs that can send our information?

Please consider editing my question if it is poorly written in your language because I am native Spanish. Thank you.

1

Yes, traffic analysis is commonly used when evaluating programs, and their interaction with their environment.

There are a few caveats to consider

  1. Encrypted traffic (TLS/SSL) - Unless you install a root certificate on the VM and actively perform a man in the middle attack to replace the certificate sent by the remote host, you won't be able to inspect encrypted traffic. This may be detectable by the program if it's using certificate pinning, it may even prevent the program from running properly if pinning is strictly enforced. If bidirectional certificates are used, then the server will also be aware of this.
  2. Many programs and malware are able to detect that they are being run in a virtual environment due to the hardware emulation. Things as simple as the MAC address being for a virtual vendor, or as complicated as specific quirks of the emulated hardware (CPU, memory, etc). A program may alter it's behavior to not act maliciously in this scenario. That can also be used to your advantage though, as some setups actively attempt to make their systems appear as a vitual machine in the hopes malware will not execute.
  • Interesting information, Thank you very much! As for certificates to decipher traffic, even though I do not have such certificates, I could check if an unknown IP is connected to my computer (which would be an alarm signal) or if it is known and does not have to be active, I could block it using the Firewall. Am I right? Would it be very difficult to detect those IPs that remain connected to my computer, using the Wireshark software? Could you provide me with a link that you know is from a good source and show this? – MarianoM Nov 9 '18 at 16:05
  • As for the malware that can detect if it runs in a virtual environment I think of it as a solution, configure from the router, the redirection of the packets to another IP of another computer connected in the same network (this computer will sniff traffic) and then allow the computer with the malware to use the connection normally while analyzing the traffic. This is possible? Can you guide me a bit or recommend a link for reading? – MarianoM Nov 9 '18 at 16:11
  • 1
    It seems like you're describing an IDS (Intrusion Detection System). SNORT has been around for many years, as well as a plethora of other programs which allow you to apply rules to your network traffic which can trigger an alert, or even an active response like blocking (although that's more of an Intrusion Prevention System). Give SNORT a look and see if that's what you're looking for. – Daisetsu Nov 9 '18 at 16:22
  • Thank you! Thank you! This is what I was looking for. Now it only remains to know how to incorporate it. Without any commitment and without intention that you do the work for me, by chance do you have any page of good source that explains from the most basic to the most advanced about SNORT? If you have it at hand, no problem. – MarianoM Nov 11 '18 at 10:16
  • 1
    SNORT has tons of free documentation (setup guides, documentation, deployment guides, faq). snort.org/documents I also seem to remember that this book was pretty good The Practice of Network Security Monitoring: Understanding Incident Detection and Response amazon.com/dp/1593275099/ref=cm_sw_r_cp_apa_Baf6BbW4QC759 it starts from the basics (no experience required), and covers all of network security monitoring, not just SNORT. – Daisetsu Nov 11 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.