54

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make everything a VM? Now all systems are safe!

I know not all malware does this but considering that there are many cloud services these days that run on VMs in remote servers does that mean that they are all immune to these types of malware?

I am aware that not all cybersecurity threats involve malware but the focus of this question is mainly on malware attacks.

18
  • 41
    The cost of "making everything a VM" is very high. Whatever that even means. The cost to make one small adjustment in the malware to also check for other things is tiny.
    – schroeder
    Feb 15 at 21:22
  • 27
    @schroeder Qubes OS does that. And yes, the cost is fairly high (large perf hit).
    – forest
    Feb 15 at 22:56
  • 33
    MOST malware runs in VMs pretty well.
    – fraxinus
    Feb 16 at 9:08
  • 147
    This reminds me of the old joke that the probability of there being two bombs on a plane is infinitesimally small, so you can keep yourself safe by always bringing your own bomb with you.
    – pjc50
    Feb 16 at 10:35
  • 31
    If everything is a VM then nothing is a VM.
    – Barmar
    Feb 16 at 18:31
132

One has to take into account why the malware is doing this distinction in the first place.

Some malware does not run in the VM because the chance is high that this VM is used for inspecting the malware (i.e. some security researcher) since most normal users don't use a VM. But if everybody is using a VM then the chance is low that the VM is used for inspecting. This means there is no real reason anymore to use this kind of simple heuristic to distinguish between a potential security researcher and a victim. Therefore this heuristic will be considered useless and a different one will be used in the future. Which means that future malware will also run inside a VM.

Note that there are also other heuristics, like checking if specific tools often used by researchers are installed on the system. Now, why not just let everybody install such tools in order to disable malware? Same reason: the heuristic will be no longer used by the malware authors since it no longer works reliably enough.

10
  • 21
    In addition to this, there are already malware that specifically target VMs - some with the intention to hijack the hypervisor or host OS (there are specific attacks that try to break out of VM sandbox). The main targets of these malware are web servers and website hosting services. They normally carry a payload of regular malware that then try to infect user's PCs that browse the infected websites
    – slebetman
    Feb 16 at 13:20
  • 37
    "Any solution to a problem changes the problem." - R. W. Johnson Feb 17 at 3:42
  • 2
    So you're saying that if I make everything a VM and install those specific tools I'll have higher security as long as other people don't start doing this? Sounds like a prisoners dilemma. So just asking for a friend, what tools are those?
    – DonQuiKong
    Feb 17 at 10:03
  • 2
    @DonQuiKong Even if everyone else starts doing it you will have higher security, just not for the reason addressed by this question/answer. Even if malware adapts to the sudden popularity of VMs, it will still be running inside a sandboxed environment to which any damage will be limited (barring hypervisor vulnerabilities). Indeed there are many software solutions which rely on sandboxing for added security, not just VMs (e.g. containers). The issue you will have with placing every package inside its own VM is the extreme cost in terms of CPU and memory resources. Feb 17 at 10:37
  • @DonQuiKong Any tool that helps you analyze malware, of course! Just make sure to tell all the malware authors that you're using it to analyze malware.
    – user253751
    Feb 17 at 11:42
7

In fact, something similar is being practiced. First of all, note the following:

  • Not all malware check for VMs, and there are other common criteria for not running such as research or monitoring tools.

  • You don't need to run in a VM. You just need to make the malware think as if you do.

One company which uses this technique is Minerva. They call it Hostile Environment Simulation:

Attackers invest tremendous efforts to develop and test malicious programs that evade your existing defenses and will only launch in an environment it considers safe. Evasive malware checks for a variety of security tools e.g. sandbox, debugger, antivirus and others, and only then decides whether or not to attack.

Minerva Labs' Hostile Environment Simulation mimics the presence of security products that evasive malware is designed to bypass. When advanced malware encounters artifacts belonging to the following categories, it shuts itself down instead of exhibiting its true nature:

  • Anti-Virus and other security solutions used for malware detection.
  • Virtual machines and emulators, used for manual and automatic malware analysis.
  • Sandbox products, used to learn the behavior of suspicious programs by detonating them in a controlled environment.
  • Forensics toolkits, used by analysts to dissect malware samples as part of forensics investigations.
4

Because malware runs in a VM.

It can not infect the host machine or other VMs.

Putting everything in VMs is still a viable way to improve security, and it is being done.

3
  • 2
    Actually some malware checks whether it's running in a VM, and if so, stops running . That's what the asker is talking about.
    – user253751
    Feb 18 at 14:34
  • 3
    It can not infect the host machine or other VMs -- it should not be able to, that is true. In practice however, exploits can break out of VM if VM has bugs, and virtually all of them do have such a class of bugs. Still, running each program in its own VM does help with damage control a lot. Feb 18 at 15:50
  • 1
    @MatijaNalis This is true - my answer was the general way (i.e. the concept), not that all VMs can always be trusted. Furthermore, infecting other VMs are still possible over the channel over that they interact (mostly, networking), it is only much more hard.
    – peterh
    Feb 18 at 16:06
4

The concept of a VM protecting from the malware is based on the idea that you run untrusted programs in a VM which has no valuable information that malware could destroy or steal.

If you put everything in a VM, that VM becomes just as sensitive to malware as the original system was.

The malware being inactive in a VM is not a protection feature: the malware expects there will be very little benefit in infecting a VM so it tries to keep a low profile until it is run on a real hardware, thus maximizing the impact. As soon as people start keeping valuable information in VMs, the malware will start infecting those just fine.

A virus which steals user's personal data from the home folder has no interest to infect an AWS instance in a VM, so yes, in that sense the VM is immune to it. Just like SIP users are immune to a virus which steals Skype passwords specifically.

1
  • 2
    No, the concept is based on the fact that some malware stops running if it detects that it's running in a VM.
    – user253751
    Feb 18 at 14:35
1

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make everything a VM? Now all systems are safe!

There is a better reason than that to put things inside a VM. Basically, the process boundary is often exploited by finding bugs in the kernel. Placing every process inside a VM machine means the malware author needs to find a bug in the kernel and a bug in the VM to escape into another process. Products like HP's Sure Click do implement the security approach you've described.

I know not all malware does this but considering that there are many cloud services these days that run on VMs in remote servers does that mean that they are all immune to these types of malware?

Yeah, there's a company that does exactly that: Menlo Security. Products like Google Docs, yes are going to be less dangerous to the user's computer than a process that runs on a local computer. Mainly because the document could be run on google's server rather than your local machine. The main target (if the malware is trying to attack the user) is going to be finding a way to exploit the user's browser via the online document. Browsers, like Chrome etc, have plenty of zero-day vulnerabilities. But over time, I think the security of the browsers have increased a lot. So it's not trivial to find a vulnerability, but it's doable.

I am aware that not all cybersecurity threats involve malware but the focus of this question is mainly on malware attacks.

Yeah these systems do significantly reduce the attack surface of a normal users activity. They haven't taken the market by storm (yet?). (There are lots of other security products that can soak up cash/security is just one of many considerations.)

There are performance considerations but they really aren't as significant (in a well engineered product) as people might expect. The products can use highly specialised cut-down vms, allowing a single machine to run many, many vms. Or a product can run multiple 'dangerous' processes in a single vm, like Hysolate. And these products can achieve near-native performance for most tasks. (The products can use a bunch of performance optimisations.)

I think some of the early creators of these solutions - like Bromium that HP bought - had some product issues that prevented the solution gaining more traction. Windows have introduced similar solutions, including Windows Defender Application Guard. Lots of very security conscious organisations like governments, big corporates etc, use virtualisation-based solutions already. In 2021, the use of these approaches is largely confined to some highly-security conscious organisations. (Excluding things like Google Docs that are mass-market for totally different reason.)

0

Some malware does not run in VM, but if you convert everything to a VM, malware will run in VM.

Want to stop malware? Implement application whitelisting and other controls from famous top 4 critical security controls publication from Australian DSD https://www.cyber.gov.au/acsc/view-all-content/publications/strategies-mitigate-cyber-security-incidents

3
  • Welcome! You basically repeat the top-voted answer then go off on a tangent on generic malware prevention (which is not the question). Can you expand on the on-topic part of the answer?
    – schroeder
    Apr 26 at 18:16
  • Hi! Well, running everything as VM would require connections between those VMs to interact and lead us to two things: 1) increasing level of complexity (with all the consequences) 2) reproducing a lot of mechanisms from operating systems concept leaving a door open to the same malware techniques concepts as usual operating systems - process injects, worm spreading, weak authentication etc. Apr 27 at 19:45
  • Can you edit your answer with these details?
    – schroeder
    Apr 27 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.