0

This question is directed towards creating an isolated environment for a reverse engineering VM, where malicious programs will be disassembled, debugged by executing them, so static and dynamic analysis etc.

  • The VM will have no internet connection.
  • Host OS: Windows 10 Pro.
  • Client/VM OS: Windows 10 Pro
  • Hyper-V is the hypervisor.
  • Most unnecessary VM features such as sound card etc. will be removed.
  • The setting "isolated" under the security tab, will be used.
  • The VM will from now on only be accessible via RDP, once you enable the isolated VM feature. enter image description here

Isn't that (RDP) a gigantic vulnerable attacking vector for any malware debugged under the VM? A RDP connection from host to client, sounds like a disaster waiting to happen, is it not? And if that's not the case, why?

According to Mitre & Tenable, there are 142-148 known RDP vulnerabilities. enter image description here

Improve this question
2
  • Welcome to the community. What is your threat model? Do you trust your hypervisor's security features?
    – Sir Muffington
    Commented May 24 at 19:26
  • @SirMuffington My threat actor is actually just CTF provided programs for disassembly, re, etc. but since the very foundation is malicious software, we should never assume that just because it's a CTF, that the programs will be safe, quite the opposite. I trust Hyper-V yes but I want to understand why RDP is used when isolating a VM, seems like the opposite of isolation.
    – stringExchange
    Commented May 24 at 21:10

1 Answer 1

Reset to default
1

The purpose of VM shielding is to protect the VM, not the host. So this feature doesn't match your understanding of an “isolated VM” which can be used to securely analyze malware. In your screenshot, the term “isolated” also doesn't appear anywhere.

If you want to access an “isolated VM” according to your definition, you can use any remote desktop or remote shell protocol you want. It doesn't have to be RDP. However, you'll face similar risks with all protocols, because their implementations will likely have vulnerabilities as well. And complete isolation obviously isn't possible, because then you won't be able to communicate with the VM at all.

And to be fair, not every RDP vulnerability allows an attacker to compromise the client. As you can already see in the first few results of your search, some vulnerabilities affect the server only, which isn't relevant in your case. But it's true that there have been major client-related RDP vulnerabilities in the past which are a threat to systems running malware in VMs.

In practice, you'll want to sandbox the VM and any program that communicates with it. For example, in Linux, it's possible to isolate VMs both from the host and each other using SELinux. There are also virtualization approaches which are specifically designed to run untrusted code.

Additionally, the host should be isolated itself and wiped regularly. Don't trust virtualization alone. It may also make more sense to use an external service which already provides those features instead of setting up your own machine for malware analysis.

Improve this answer
1
  • 1
    Don't forget to mention AppArmor too :-)
    – Sir Muffington
    Commented May 25 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .