I intend to start learning how to do malware analysis and forensics, but I have a concern or two.
I want to start by just analysing code that I write myself, and that'll be fine. But at some point I'm going to want to start analysing real malware.
As is normal, I'll be analysing within a Windows VM (on a Windows host), with something like INetSim hooked in and all that.
My concern, however, is around VM escapes. How concerned, or not, should I be about VM Escapes, if I keep my VMWare Workstation up-to-date? I've looked around the internet, but the general literature out there seems to be focused a lot on enterprise/cloud VM escapes in the sense of accessing other VMs on the same physical hardware. I'm not sure how much this could apply to a non-enterprise situation, where the concern is an attack on the host, rather than on different guests.
Is this one of those cases where the malware would need to be very specifically written to escape the VM, and if I'm doing proper research on the samples I intend to analyse then it shouldn't be a concern?
I guess the other question is that, beyond the obvious disabling external internet access (i.e. putting the VMs on host-only/internal networking) as soon as the samples are downloaded, are there any other sensible precautions I should be taking?
Thanks in advance