1

I've tried searching for methods of scanning files within virtualbox, but most (if not all) of what I find is discussion about studying programs that are already known to be malware. I'm trying to determine if something is malware or not, and I don't exactly know what to do to determine this manually rather than just relying on an antivirus scan of some kind. Are there ways to scan the files from a program on the host computer or within the vm itself? Or is relying on an external program just not the right way to go about this?

1 Answer 1

2

Such methods may prove extremely difficult.

The virtualization process involves slicing/dicing data elements inside of the guest, making them very difficult for a an anti-malware tool to recognize. Consider two areas that anti-malware tools heavily scrutinize to find malicious code: memory and file systems. Let's consider a non-virtual machine first.

It's important to note that even non-virtual machines have virtual memory. Most modern operating systems have a virtual memory system that breaks up data inside the machine; these parts are called memory structures. Using several tables, the virtual memory is then mapped to physical hardware storage addresses. The memory structures make each program on the machine believe that there is an enormous amount of memory, even though physical RAM is actually limited. Most modern operating systems support virtual memory by swapping data between RAM and the hard disk or other high-volume storage devices.

In a virtual machine environment, the guest has its own virtual memory system, as well as its own tables that map various applications' view of memory to physical memory. But the physical memory of the guest machine is actually inside the virtual memory of the host machine, which is mapped into the physical memory underlying the host.

With all of the indirection here, it's no wonder that it's hard for an anti-malware tool to see inside the host and figure out what's going on inside the virtual workstation. To scan the virtual system's memory for malware, the host anti-malware tool would have to read and discern all of the virtual memory tables of the guest in real time. You might be thinking, "But it would just have to look for a few thousand strings in contiguous spaces in memory, right?" Not exactly. From the host's perspective, the strings to search for may not be contiguous at all since the guest's virtual memory system has been sliced and diced.

A similar issue happens in the file system. In most virtual machine implementations, the guest's file system is merely a big file in the host machine. But all kinds of formatting information is stored within that file, and any malware files here are broken down into different pieces that are then distributed throughout.

To scan the host machine, the anti-malware scanner can rely on the operating system itself to group hard drive sectors into files. But, the anti-malware scanner doesn't have that luxury inside the guest, where the guest's own file system breaks things down into virtual sectors and does so inside that big file on the host's hard drive.

Now, creating an anti-malware tool that can run on a host and determine what's happening in the guest is theoretically possible and could be a very powerful tool in one's arsenal. Its architecture though would likely be different from many of today's anti-malware tools. Such a tool could implement its own code to discern a guest's virtual memory and file system. Alternatively, the tool could rely on software in the guest to do this unraveling; this would require hooks into the guest, however, and an extension of the anti-malware tool from the host into the guest itself.

Another option would involve a different kind of anti-malware tool that, instead of looking for a series of signatures, would look for other anomalies inside the guest. These anomalies can be more easily discerned from the host and wouldn't require a complete mapping of memory and the file system.

Such tools may exist in the future.

Original article link here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .