Reverse Engineering Malware 101

Re:Reverse Engineering Malware 101 by moyix on Wednesday March 29, 2017 @05:59PM (#13991007)

Not widespread is a bit of an understatement. In the context of malware analysis I would be astonished if someone bothered to use a VM escape bug. They're valuable; you don't waste them by sticking them in a piece of malware to pwn some poor malware analyst's machine.

VM detection is much much easier, so there's not much point.

[ Parent | on HN ]

Re:Reverse Engineering Malware 101 by matt_wulfeck on Thursday March 30, 2017 @02:38AM (#13993407)

I was thinking the same thing. Who would waste an unpatched vm escape bug just to nab some poor souls laptop, which can be wasted and reformatted in an hour? Sounds like a colossal waste and I bit there's very, very few (if any) examples of it happening in the wild.

[ Parent | on HN ]

Re:Reverse Engineering Malware 101 by giancarlostoro on Thursday March 30, 2017 @03:31AM (#13993593)

I have a feeling escaping from Windows into a Ubuntu host system would not be as effective (though I wouldn't doubt it impossible) as escaping into a Windows OS which is usually the bigger / main target for malware.

[ Parent | on HN ]

Re:Reverse Engineering Malware 101 by Kalium on Wednesday March 29, 2017 @06:03PM (#13991046)

Yeah. Unless the analyst is your target environment, I wouldn't expect to see it a serious current VM escape.

I might expect to see someone including an antique attack against some old Sandboxie or something, but nothing more.

[ Parent | on HN ]