Re:Reverse Engineering Malware 101
by lawnchair_larry on Thursday March 30, 2017 @10:31AM
(#13995641)
No real world malware has had a vm escape.
that we know of
How common are VM escapes anyway?
Not widespread, but they do exist.
https://www.zerodayinitiative.com/blog/2017/3/16/pwn2own-201...
Not widespread is a bit of an understatement. In the context of malware analysis I would be astonished if someone bothered to use a VM escape bug. They're valuable; you don't waste them by sticking them in a piece of malware to pwn some poor malware analyst's machine.
VM detection is much much easier, so there's not much point.
Re:Reverse Engineering Malware 101
by matt_wulfeck on Thursday March 30, 2017 @02:38AM
(#13993407)
I was thinking the same thing. Who would waste an unpatched vm escape bug just to nab some poor souls laptop, which can be wasted and reformatted in an hour? Sounds like a colossal waste and I bit there's very, very few (if any) examples of it happening in the wild.
Re:Reverse Engineering Malware 101
by giancarlostoro on Thursday March 30, 2017 @03:31AM
(#13993593)
I have a feeling escaping from Windows into a Ubuntu host system would not be as effective (though I wouldn't doubt it impossible) as escaping into a Windows OS which is usually the bigger / main target for malware.
Yeah. Unless the analyst is your target environment, I wouldn't expect to see it a serious current VM escape.
I might expect to see someone including an antique attack against some old Sandboxie or something, but nothing more.
Isn't VMware in Windows rather a special case? They've been working together for so many years, after all.
Any known breakouts from Windows guests in VirtualBox on Linux?
http://venom.crowdstrike.com/
There have been others. In short, no VM is completely safe.
Broadly, it's not a reliable approach and relies to a surprising extent on the cooperation of the malware package.