More advanced users could use snapshots to keep different saved states, but by far the most common use of a snapshot, for people who use a virtual machine to test software, is:
- You make a snapshot of the machine after you do the operating system install and after you have updated the operating system.
- This is your base snapshot of your known trusted good machine.
- Then when you want to test something you install it, test it, and then eventually REVERT to your base clean snapshot.
That is, you are always going back to your known trusted good clean snapshot after you finish a round of testing.
As has been pointed out by others, in theory a virtual machine is immune to attack by malware, but you should consider a few things before unleashing known malware in a virtual machine:
- You have to be careful if your virtual machine is able to access the network -- especially because it may look to your real host computer and others on the network, as if the virtual machine is a "trusted" machine on your LAN. One nice feature of a virtual machine however is that you can DISABLE network connectivity with a simple option, thus locking down the machine from any network access.
- You also have to worry about any SHARED FOLDERS that the virtual machine software may set up. A malware could infect such shared folders.
- Lastly, there is always the possibility that a malware will be specifically coded to exploit bugs in a virtual machine software and "break out" of the virtual machine. This is not a purely theoretical concern -- I have read about virtual machine exploits -- though I don't have any idea how rare they are. But you should always be cautious about assuming that a virtual machine provides 100% secure testing environment for truly malicious malware.
Recent Posts