Re:Virtual Machine Detection in the Browser (2019)
by gruez on Saturday December 19, 2020 @09:12AM
(#25477486)
>- Do network adapter MAC vendor ID's make sense?
>- Does the hard drive size make sense?
not detectable through browser APIs
>- Which 3D acceleration features are supported/work correctly?
vmware workstation has 3d acceleration support targeting directx 11, so I'd imagine most features are supported and are passed through to the host gpu for execution. I doubt you'll able to detect is a vm or not based on that. In addition, resistfingerprinting (on firefox) hides this kind of stuff.
>- How much graphics RAM is there?
vmware workstation has vram selectable from 32MB all the way to 8GB, so that covers the entire range of plausible vram sizes.
>- Timing-based methods
what else can you test that is both accessible via browser api and would yield big differences between a vm and a slow computer?
>It's a bit like detecting private/incognito mode in a browser. Everything worked great, until websites realised there are ways to detect it, then became a game of cat and mouse.
not really, it's a solved problem: make a new browser profile and then delete it after you're done. I've seen a few HN commenters post their (relatively short) scripts to make a new firefox/chromium, start it, and then automatically delete it once it exits.
>- Does the hard drive size make sense?
not detectable through browser APIs
>- Which 3D acceleration features are supported/work correctly?
vmware workstation has 3d acceleration support targeting directx 11, so I'd imagine most features are supported and are passed through to the host gpu for execution. I doubt you'll able to detect is a vm or not based on that. In addition, resistfingerprinting (on firefox) hides this kind of stuff.
>- How much graphics RAM is there?
vmware workstation has vram selectable from 32MB all the way to 8GB, so that covers the entire range of plausible vram sizes.
>- Timing-based methods
what else can you test that is both accessible via browser api and would yield big differences between a vm and a slow computer?
>It's a bit like detecting private/incognito mode in a browser. Everything worked great, until websites realised there are ways to detect it, then became a game of cat and mouse.
not really, it's a solved problem: make a new browser profile and then delete it after you're done. I've seen a few HN commenters post their (relatively short) scripts to make a new firefox/chromium, start it, and then automatically delete it once it exits.