1

I am redirecting URLs to a virtual machine (Windows operating system) to check if there is malware on the website i want to visit (JavaScript attacks, drive-by download attacks, infected pictures/PDF files or executables embedded on the webpages ...).

In the case there is a webmalware embedded on one of the webpages: what aspects of the virtual machine must I check for eventual changes done by the webmlware ?

1

Nothing should be changed except the downloaded Internet files.

I would take a snapshot of the fresh VM and revert back every night (or sooner if it detects evidence of malware). That way, it is free to be compromised, but you limit its effect.

Unless you hope to inspect changes in the VM as the method of detection that there has been malware, in which case you simply look for ANY changes outside of the downloaded Internet files.

It looks like you are trying to combine a proxy with a sandbox? Sandboxes are best used in parallel and not in-line for safety sake.

  • But there are JS attacks that (even benign) change the default homepage of the browser, or adds toolbars to it (spyware, adware ...), or if a serious drive-by download attacks lead to installing a serious virus ... I want to say there are lot of changes that can happen apart from the downloaded files. – user45139 Jul 10 '14 at 14:16
  • A question if I may: what do you mean by "reverting back a VM" ? – user45139 Jul 10 '14 at 14:17
  • 1
    Toolbars get installed outside of the downloaded Internet files folders, and homepage changes are made to the user's profile, which is also outside. – schroeder Jul 10 '14 at 14:21
  • If you take snapshot of a VM, you can 'rollback' a VM to the snapshot's point in time. Google "revert snapshot" – schroeder Jul 10 '14 at 14:22
  • I think I understand now your 3rd paragraph of your answser. But that is exactly what I am looking for: what are the various changes may I look for ? I need such information because I am building a program that must check the maximum modifications on the system (VM) that malware could do. – user45139 Jul 10 '14 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy