News for hackers. Stuff that matters.

A comment on Virtual Machine Detection in the Browser (2019). Parent comment

Re:Virtual Machine Detection in the Browser (2019) by Wowfunhappy on Friday December 18, 2020 @10:58PM (#25474887)
...no, that's where I don't agree. Again, software should attempt to be truthful by default. There's a reason we allow programs to detect the hardware they're running on—it allows for all sorts of optimizations.

Does the VM claim it's network driver was manufactured by Broadcom, or does it go with Cambridge Silicon Radio? Or does it decline to provide a vendor, and if it does, how long until software starts assuming that is the sign of a VM, except this time with potential false positives for users of niche hardware?

[ Parent | on HN ]
Re:Virtual Machine Detection in the Browser (2019) by yjftsjthsd-h on Saturday December 19, 2020 @12:40AM (#25475376)
I think a key distinction is whether we're in an adversarial context or not. And I think loading untrusted applications over network connection from arbitrary third parties is absolutely a position to be distrustful.
[ Parent | on HN ]
Re:Virtual Machine Detection in the Browser (2019) by userbinator on Saturday December 19, 2020 @03:41AM (#25476122)
Does the VM claim it's network driver was manufactured by Broadcom, or does it go with Cambridge Silicon Radio?

It would simply be whatever the virtual NIC is. Intel ones seem to be pretty common, likely due to wide availability of drivers and documentation.

[ Parent | on HN ]
Re:Virtual Machine Detection in the Browser (2019) by elcomet on Saturday December 19, 2020 @02:57AM (#25475907)
It could report the host's hardware.
[ Parent | on HN ]
Re:Virtual Machine Detection in the Browser (2019) by Wowfunhappy on Saturday December 19, 2020 @09:58AM (#25477753)
But now you're leaking information about the host, which I would think is worse given the purpose of a VM.
[ Parent | on HN ]
Re:Virtual Machine Detection in the Browser (2019) by ruslanbogan on Saturday December 19, 2020 @10:35AM (#25477994)
It would have to emulate the host hardware to do that because the fingerprint is only going to report what's listed in Device Manager for instance.
[ Parent | on HN ]