lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <40964AE9.16693.BEFC8B51@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Unpacking Sasser

"Lee" <cheekypeople@...33.com> wrote:

> As a side note I use Vmware workstation and GSX server edition to create
> enviroments that can be trashed and re-used at will, just wanted to add
> another secure way of testing malware etc...

"Secure" so long as you are careful with the the virtual-to-physical 
network configuration.  Far too many are not...

Also, as with running under a debugger, the VM environment can be 
sensed by the code being tested and choose to act entirely differently 
from how it would otherwise.  There is malware that does this and there 
will be more in future, so as always "Don't try this at home kids"...

In short, whilst careful and thoughtful analysis can be greatly aided 
by tools such as VMWare and SoftICE, simply running or tracing a 
suspect .EXE under such an environment is far from sufficient if "a 
modestly adequate analysis" is the desired result.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ