This is a nice article on the matter: http://web.archive.org/web/20110929075510/http://invisibleth.... It doesn't appear to work reliably anymore, but the principle is the same.

Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.

Well, there are a couple things - For one, the hypervisor presents different "hardware" than you would get in a standard HP or Dell box. And often the hypervisor has a driver package to install, to facilitate communication between the OS and hypervisor - this is used mostly to manage memory overcommit with things like a memory bubble.

As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.

Well, on a Windows VM in VMWare products, you can just ask the OS and it will happily report the manufacturer as "VMWare, Inc" for example. I would expect other virtualizers to do something similar, if not there in some other places (like drivers etc).

You can emulate a PC perfectly. But in practice there's a tradeoff between perfect emulation and performance, and since a VM's goal is typically to run cooperative software quickly, they aim for performance.

For example, for best performance you want to run the instructions in the VM directly on the hardware CPU so that they run as fast as they would outside the VM. But not all instructions can be run safely this way, so the VM will trap some and emulate them. This is necessarily slower, so a program can detect the presence of a VM by noticing that some instructions are much slower than they ought to be. You can lie about the time, but the bookkeeping needed to do so accurately imposes a lot of overhead.

I've heard that it's mostly searching for VM addon software used in VMs, like VirutalBox Guest Additions.

>in fact if you're going to do malware stuff like this, why even ask?

Just a guess, but probably plausible deniability reasons for when they're inevitably brought to court.

there is no plausable deniability if it does something different in a VM. that takes active coding to set up, there is no reason anyone would ever have any code that has this effect.

There are PLENTY of reasons to code your application to act differently based on environment... while many of them may be bad, not all of them are.

Some abuse this to make speed tools run faster, ala Graphic Card tests that run faster when it detects NVidia/AMD... some abuse it to skirt protections in VMs...

Do we need to ban torrents because a lot of torrents are illicit materials? Ban bitcoins, because some people use it for drugs? Ban tor?

I was only referring to the "why even ask?" part of your post. They most likely ask during the installation for liability purposes.

VM behavior or not, asking or not, I've hoped they get in legal trouble for this as soon as I knew about it, but of course, IANAL.