2

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and hide their iframes for VM visitors ?

Edit: does browser attacks effect QEMU as well ?

1

Yes...

Google VM detection and you will see that there are numerous ways to detect environment variable signatures that are giveaways to being inside of a VM. Most of these can be done from JS, some more difficultly than others, but still done. Bottom line, detecting you are running in a VM is really not too hard and whether you are running JS or not is not the issue.

Here is an article on exactly how one researcher showed you could using MAC address detection.

http://carnal0wnage.attackresearch.com/2009/04/detecting-vmware-with-javascript-or-how.html

  • is there any virtualization software (e.g QEMU) to prevent just a web page detect we are using virtualization? – w00dy Mar 29 '13 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.