Slashdot Mirror
Attacking Sandboxes
SkiifGeek writes "Many anti-malware applications use a sandbox as a tool to help identify potentially malicious software. Now knowledge is spreading about techniques and methods that can allow sandboxed software to target the sandbox itself (and by extension the application that applied it). While attacks that specifically target sandboxing applications are probably a little way off, this technology can be considered the logical extension of techniques and procedures to identify the presence of hosted systems (VMWare, Virtual PC, etc.)."
That's ok. We can just sandbox the sandbox and still be safe.
for building a box out of sand. what were we thinking?
Bite my shiny metal ass.
Theres a simple detection program called RedPill that probes a simple method to do so, vmware leaves a lot of registry keys on windows, VirtualBox lacks supports for hardware breakpoints, cpu cycles counts is another way to detect virtualization, and some packed malware dont even run on virtual machines because of memory management, software packed with armadillo do not run on vbox and it used to fail on vmware player until they fixed that bug.
"Thwarting Virtual Machine Detection" is a nice paper on virtual machine detection.
There will never, ever be an end to this.
As long as people are imperfect (and they always will be) there will be measures, countermeasures, and counter-counter measures. New techniques will make old ones obsolete, and even newer techniques will make the once-new techniques no longer apply.
With this understanding, any technology that can outsurvive more than one or two iterations of other products in the same field becomes "venerable" and "stable".
Which makes now a particularly good time to appreciate the guys who worked out the spec for TCP/IP some 30 (?) years ago. Despite going from mainframes, to minis, to PCs, and now on to the era of ubiquitous computing, the basic concepts and ideas behind the TCP/IP specification continue to hold steady and useful. They managed to come up with a technology, that whatever flaws have actually been found, hasn't come up against any real show-stoppers. None.
To which I can only say: WOW.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The article didn't say that they've found code that attacks sandboxes, it said that they've found code that detects a sandbox (VMWare for instance) and plays innocent so as to avoid detection through the sandbox.
It also said that software has been found that detects when it's attached to a debugger. Big deal, copy protection schemes have been doing that for decades.
The article then goes on to FUD that code that attacks the sand box "must" be coming.
Oh, it must be coming. Uhuh.
That malware detects VMs is old news. I'd wager about 60% of current malware has VM detection built in. About as many have debugger detection. Some overlapping allowed.
So far, malware that "breaks out" of the sandbox would be new to me (though I'd be grateful for a sample). Though, seriously, why not run a VM with Windows (to analyze) on a box running Linux? I'd be very interested if someone manages to do the feat of creating a piece of malware that manages to break out of the sandbox and then run on a machine with a completely different operating system.
If you wanna throw another stick between the malware's feet, run the VM on a non-i386 architecture. If someone manages to break out of THAT and manages to hijack my machine, he really earned it and should get it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I've got friends who know how to block your friend's actions.
I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
Just remember....recursive code is great code, because its recursive, so its great.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
There is no spoon
Can You Say Linux? I Knew That You Could.
Isn't once enough for anyone? You did format and restore from a known good backup or install media afterwards didn't you? There's a tendency lately to trust that whoever had full control of your PC did nothing but run a set script and blindly hope that there is nothing else on there. I've played with various removal tools when people have given me compromised machines and different tools gave me different answers the other tools could not detect - perhaps there were some things neither could detect, hard to be sure especially when you are booting from a compromised system.
Fdisk it from orbit - it's the only way to be sure.
"Fdisk it from orbit - it's the only way to be sure."
s /secmgmt/sm0504.mspx
Even Microsoft agrees with you. You can't "clean" a compromized machine.
http://www.microsoft.com/technet/community/column
That goes for other OSes too.
--
BMO