I have been reading about SpyProxy. Can someone explain me this phrase I found in the article ? Here it is: We monitor the guest OS and browser through “triggers” installed to look for sandbox violations.

I am looking to understand what is the nature of the triggers they may install in the Virtual Machine ? I appreciate any help/indication.


I would assume you understand what is going on here: when you try to visit a webpage, your browser is configured to use this AV as a "proxy." Instead of TRULY proxying the connection, the AV downloads the webpages (probably non-proxied) and opens them on a VM. It then (probably) checks for changes to the filesystem that could be interpreted as suspicious. For instance, modifications to system32 or Program Files (x86) (assuming you're on Windows) would be detected and the webpage would be blocked. Assuming no suspicious changes are found, (most likely in the virtual memory as well as the filesystem) the program fulfills its perceived role as a proxy and "forwards" the web page to you. The advantage of this is mainly that previously undiscovered viruses are still blocked, but disadvantages include poor performance. Also, a determined attacker wouldn't have too much trouble getting around this system (depending on how rigorous their algorithms for checking the VM are).

EDIT: To be a bit clearer, while there are undoubtedly some triggers installed on the guest OS, most of them are probably installed as part of the program and are separate from the OS entirely.

  • Thank you very much for the explanation. One last question for you, if I may: what if that VM crashes because of a given malware located in the webpage? The proxy can not get results from the VM then ! – user47731 Jun 3 '14 at 16:10
  • 2
    @massinissa That's a valid question. VM's use Virtual Disks as their hard drives. Virtual Disks are actually files stored on your hard drive. VM software will then provide a way for the guest OS to store or read files to/from them. You don't actually need the VM software to read the files. Even if this weren't true, the VM would never return the value used to show that the webpages is clean if it crashed, so you wouldn't be able to access the web through that browser at all until it came back online. – KnightOfNi Jun 3 '14 at 16:25
  • But SpyProxy is a nice tool, so they may have implemented a method to avoid the VM crashing ? – user47731 Jun 3 '14 at 16:37
  • 2
    @Massinissa Never having used SpyProxy, I couldn't really say, but I suspect that the method they use is far simpler than that. They can simply allow the VM to crash when it crashes, and then just create a new, blank virtual disk and use that one instead. A new disk might also be created each time the program starts. – KnightOfNi Jun 3 '14 at 20:26
  • I think your answer is logic, they can not prevent the VM from crashing. But when creating a new one, how is it possible to automatically create/install it without a human intervention ? Any idea, please ? – user47731 Jun 4 '14 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy