Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable?

Please note: I will be browsing via tor and kproxy and have all that setup. So, again, the question pertains to the relative increase/decrease in security which a VM offers.

This question is being asked as a White Hat pentester in training.

  • 4
    I understand that this is a curiosity question, but what colour hat are you wearing? You should only run pentests when you have permission - or are being paid - to test the server, anonymity shouldn't be an issue with a pentest. Jul 25 '15 at 14:38
  • 5
    @MikeOunsworth There are cases where the pentest should be performed under realistic conditions (including the use of anonymizing techniques), especially to test defense measures and incidence response.
    – Gumbo
    Jul 25 '15 at 15:15
  • 1
    Valid observation, Mike. Thanks. But Gumbo gets it. Black Hats do not ask for permission to access my clients' sites, run NMAP and NESSUS and compile reports as to which ports are open. They sneak in, cloak themselves, observe, mount a malicious strategy and by the time they strike with an XSS or an SQL injection it is all over. And the real questions here are how do they protect their anonymity in the first place, how do they cover their tracks and how might launching an attack via a VM increase/decrease efforts to catch them?
    – Joel
    Jul 25 '15 at 16:21
  • When you speak of browsing in your question, do you mean "web browsing" or "vulnerability scanning"?
    – dan
    Jul 25 '15 at 17:56
  • Sorry, Azuelo, I really am a newbie to all this. Clumsy use of terms there. On the other hand, I suppose the answer is "both." Does it matter? Thanks.
    – Joel
    Jul 25 '15 at 20:29

A very common and highly-modernized attack is running AntiDetect on FraudFox. Criminally-minded adversaries discuss using these tools on leakforums, among other dark corners of the Internet. Obligatory video here -- https://www.youtube.com/watch?v=ZQN7CyCXh90

FraudFox is a guest VM used to hide digital fingerprints. More information here -- http://www.infosecisland.com/blogview/24258-Can-Hackers-Use-FraudFox-VM-to-Defeat-Your-Fraud-Prevention.html

  • those tools are commercial
    – user45139
    Jul 26 '15 at 7:18

Usually the main purpose of a VM is to prevent accidental leaks that may compromise someone's anonymity (by preventing the VM from communicating via anything but Tor), however in your case I assume you have consent from the website's owner to do the pentest so even if you do leak some data that may identify you, it's not a big deal.

As far as anonymity to an IDS (or more like detectability, since IDS doesn't care about your identity), VM or not shouldn't make any difference as the tools you'd use in a VM or on your real machine would be the same, however the simple usage of Tor can bring up some red flags on the IDS. Again, I assume you have consent from the owner, so why not simply use your personal internet connection, a coffee shop's one or a throwaway prepaid SIM card ?

  • In case of a commissioned pentest, being able to identify the legal attacker (e. g., fixed IP address) is often part of the contract.
    – Gumbo
    Jul 25 '15 at 15:08
  • Yes, but only management knows that a engagement is on-going. Network engineers, NOC/SOC, developers, they don't know, and that should be what the question and responses are about.
    – user79537
    Jul 25 '15 at 16:13
  • My assumption is that the behaviors of a real threat are operating under the conditions of anonymity and non-traceability. A pentest should operate under the same conditions, right?
    – Joel
    Jul 25 '15 at 16:33
  • Anonymous. Yes, make the assumption that I have consent of the owner. Is there no way to mask the user agent and cloak Tor so that it does not set off alarms?
    – Joel
    Jul 25 '15 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.