When testing untrustworthy software, remember virtual machines can be escaped

[mouser]

For those of us who occasionally test "untrustworthy" software from sources we can't be sure of, using a virtual machine is generally considered "safe".  Whatever happens in a virtual machine stays in a virtual machine -- or so we hope.

This is just a reminder that malware authors are actively trying to find ways to break out of virtual machines and infect the host pc, and to be careful.

Contestants at this year's Pwn2Own hacking competition in Vancouver just pulled off an unusually impressive feat: they compromised Microsoft's heavily fortified Edge browser in a way that escapes a VMware Workstation virtual machine it runs in. The hack fetched a prize of $105,000, the highest awarded so far over the past three days.

https://arstechnica....hat-escapes-vm-by-ex

[cranioscopical]

So one should be cagey?

[Deozaan]

That's why I always test untrustworthy software on Amazon instances. Let them deal with the malware.

(I don't actually do that.)

[wraith808]

(I don't actually do that.)

-Deozaan (March 20, 2017, 01:09 PM)

(That you'll admit )

[panzer]

I used to test software on CIA's computers but one day they said that I have managed to infect their entire grid with malware they created and that I have to test software at NSA from now on.

[Shades]

So one should be cagey?

-cranioscopical (March 20, 2017, 11:46 AM)

The "vault" at fault, you could say... 

[MilesAhead]

Amazon instances

-cranioscopical (March 20, 2017, 11:46 AM)

It may be best to use digital paper.  Burn it when done. 

[cranioscopical]

So one should be cagey?

-cranioscopical (March 20, 2017, 11:46 AM)

The "vault" at fault, you could say... 

-Shades (March 20, 2017, 08:54 PM)

You know that this will end in gridlock.

[MilesAhead]

So one should be cagey?

-cranioscopical (March 20, 2017, 11:46 AM)

The "vault" at fault, you could say... 

-Shades (March 20, 2017, 08:54 PM)

No doubt a combination of factors caused it to take a tumble.

[f0dder]

While VMs can be escaped, you should keep in mind that a VM escape is an extremely valuable 0day.

So, if you get a piece of "interesting software" containing a VM escape, there's basically two scenarios:

1) you're targeted by a nation-state, YOU'RE GONNA DIE AND THERE'S NOTHING THAT YOU CAN DO ABOUT IT.
2) you're dealing with a potentially nasty piece of malware, but it's using publically-known escape techniques.

Keep your VM software up-to-date! And don't even think about using sandboxing/containerizing software for testing BadStuff.

PS: while you're not super likely to find VM-escape in the wild, it's a lot more common for malware to have VM detection - meaning it won't activate when running in a VM, so it lulls you into a false feeling of safety.

[mouser]

F0dder -- thank you for your wisdom -- very helpful.

PS: while you're not super likely to find VM-escape in the wild, it's a lot more common for malware to have VM detection - meaning it won't activate when running in a VM, so it lulls you into a false feeling of safety.

Excellent point I hadn't even considered.