1

I intend to start learning how to do malware analysis and forensics, but I have a concern or two.

I want to start by just analysing code that I write myself, and that'll be fine. But at some point I'm going to want to start analysing real malware.

As is normal, I'll be analysing within a Windows VM (on a Windows host), with something like INetSim hooked in and all that.

My concern, however, is around VM escapes. How concerned, or not, should I be about VM Escapes, if I keep my VMWare Workstation up-to-date? I've looked around the internet, but the general literature out there seems to be focused a lot on enterprise/cloud VM escapes in the sense of accessing other VMs on the same physical hardware. I'm not sure how much this could apply to a non-enterprise situation, where the concern is an attack on the host, rather than on different guests.

Is this one of those cases where the malware would need to be very specifically written to escape the VM, and if I'm doing proper research on the samples I intend to analyse then it shouldn't be a concern?

I guess the other question is that, beyond the obvious disabling external internet access (i.e. putting the VMs on host-only/internal networking) as soon as the samples are downloaded, are there any other sensible precautions I should be taking?

Thanks in advance

  • It should be safe as long as you're looking at old malware. Be aware that malware can also attack your traffic analyzer software from within the VM, so you won't want to run that on your host. – user Dec 9 '19 at 19:19
  • OK, thanks. Yeah it'll mostly be old malware. Any newer malware I analyse will be ones that have already been thoroughly analysed elsewhere so I know what it'll be trying to do. As for the analysis tooling, that'll all be running from within the VM so it should be fine in that regard. – Makcheese Dec 9 '19 at 19:25
  • The only other thing I could think of is simply deleting any VMs you run the malware on quickly, and documenting which ones you're running them on. You wouldn't want to accidentially re-use a VM that's infected with something for some other, non-malware purpose. – Steve Sether Dec 9 '19 at 19:50
  • That's a good point. I'll likely just revert the VM to a snapshot after analysis every time. – Makcheese Dec 9 '19 at 20:00
0

TL;DR version: You should not be worried about VM-escaping malware if you do things right - the likelihood of that is pretty low.

Having said that, the internal networking scenario you described (common virtual between host and guest) is not sufficient to protect against VM escapes in the form of worms. Most host services would listen on any network interface, including the internal virtual interface that is common with your guest. This means that malware with worming capabilities looking to exploit vulnerabilities over the network (e.g. the good old WannaCry-wannabe's gunning for EternalBlue, the new kids with BlueKeep, etc.) executed on your guest may be able to reach your host via the shared network.

The answer is simple: isolate the two as much as possible, with no common network interfaces between the host and guest.

In my years of digging through harmful code, malware capable of escaping VMs has been extremely rare - threat actors are frequently staging their attacks, with multiple downloadable components, so they don't burn all of their tools early in the chain. VM escapes come really late in the game, when the threat actor has ascertained that they are not on a honeypot or a forensic station, they are certain they have not been detected, and then and there they would initiate a next-stage download.

Most of the time malware would run checks if they are in a "sandboxed" environment, e.g. it will check for Internet connection, presence of virtualization, and several other criteria (such as the presence of meaningful files in the user's profile) - these are usually the tell-tale signs that the code is executed in a sterile "forensics" environment, and the code will simply not run. So completely cutting the Internet may also not be feasible.

It's best that you do your experiments in a completely segregated environment, but that's not always feasible, especially for the novice - the investment may be substantial.

Hope this helps!

  • Thank you very much for the insights! That's put my mind at ease a bit. I'll have a think about how to airgap the network interfaces between the guests and the host (I hear that virtualbox has an "internal network" that is different than its Host-Only networking implementation; maybe that will be useful?) – Makcheese Dec 9 '19 at 20:30
  • @Makcheese All of the popular virtualization hosts support internal/VM networks. – user Dec 9 '19 at 20:34
  • Ah, cool, I guess I just overlooked that functionality on VMWare ha – Makcheese Dec 9 '19 at 20:36
  • @Makcheese You'll probably need to set up a custom network adapter, and have a private "LAN segment" that only the VMs will use. – user Dec 9 '19 at 20:41
  • I see, thanks very much for the help! – Makcheese Dec 9 '19 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.