full-disclosure - Unpacking Sasser

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: cheekypeople at sec33.com (Lee)
Subject: Unpacking Sasser

Hi Nick thanks for the comments, I can see your point, I do take advantage
of the vmxnets in vmware to stop anything coming out but a remote ssh
connection in, like always, "understand what you use, not take it for
granted" applies.

I am intrigued by your points of malware understanding the environment

"VM environment can be
> sensed by the code being tested and choose to act entirely differently
> from how it would otherwise."

I have never seen this before, have you any pointers for me?  I use ESX
server alot and malware been able to detect my environment is something I
havent seen before. Would kind of go against the very nature of ESX server,
like said, very interested on this as it would help to safe guard our
testing environments.

What suggestions would you give for creating an adequate environment?

Kind Regards

Lee @ STS
http://www.seethrusec.co.uk
Building Knowledge and Security..
----- Original Message ----- 
From: "Nick FitzGerald" <nick@...us-l.demon.co.uk>
To: <full-disclosure@...ts.netsys.com>
Sent: Monday, May 03, 2004 2:36 AM
Subject: Re: [Full-Disclosure] Unpacking Sasser


> "Lee" <cheekypeople@...33.com> wrote:
>
> > As a side note I use Vmware workstation and GSX server edition to create
> > enviroments that can be trashed and re-used at will, just wanted to add
> > another secure way of testing malware etc...
>
> "Secure" so long as you are careful with the the virtual-to-physical
> network configuration.  Far too many are not...
>
> Also, as with running under a debugger, the VM environment can be
> sensed by the code being tested and choose to act entirely differently
> from how it would otherwise.  There is malware that does this and there
> will be more in future, so as always "Don't try this at home kids"...
>
> In short, whilst careful and thoughtful analysis can be greatly aided
> by tools such as VMWare and SoftICE, simply running or tracing a
> suspect .EXE under such an environment is far from sufficient if "a
> modestly adequate analysis" is the desired result.
>
>
> -- 
> Nick FitzGerald
> Computer Virus Consulting Ltd.
> Ph/FAX: +64 3 3529854
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>