[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On 21/12/11 16:05, tom wrote: > I dont know if you've heard of this safari crashing w7 thing but I was > wondering if anyone has experience of debugging the OS in a VM - i.e. > could I re-produce the crash and then examine the VM setup for > debugging purposes? > This would, I image, be a very easy way for a bad hacker to get in, > find an reproduce the problem and build on it. > > Just wondering > Tom te tom te tom > Yes and no - mostly no though. Debugging in a VM is fine and except for certain known issues, is the primary method most researchers/hackers/etc use when investigating/developing vulnerabilities - the ability to use multiple snapshots is invaluable for example. The real work however will still be done inside the VM with your regular debugging and disassembly tools: you can't just magically completely deconstruct the entire attack surface and code execution path by diffing a before and after exploit VM image (think about it: if it was this easy then anyone with a copy of Virtualbox would be writing rootkits). In my experience at least, VMs are a useful tool for analysing the effects *caused* by malware and tracking the filesystem writes, network I/O and any other mischief the payload brings, but actually understanding *how* the malware code originally executes requires an in-depth understanding of the stack, kernel internals, memory addressing and countless other factors that are not necessarily exposed further merely by virtue of the target OS being virtualized rather than bare metal. In fact, unless you're specifically targeting the virtualized system ecology with your zero day (and many do, who wouldn't like to be able to break out of jails/chroots/LPARS/VPARS/etc to the hypervisor?) the massive added complexity overhead of a VM brings many complications to malware development and many prefer to do initial development on bare metal. Shell code is complicated enough as it is without ring -1 getting in the way. Saying all that, you'd be surprised what can be pulled out of the pagefile.sys from a crashed virtualized victim box sometimes though - or the swap partition. As for the initial issue, Safari on win7: ha ha. Rather them than me, talk about the worst of both worlds... Cheers, Mat -- The Mailing List for the Devon & Cornwall LUG http://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq