Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 87 guests online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow Help with Lab setup
EH-Net
May 26, 2012, 04:32:07 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Help with Lab setup  (Read 14703 times)
0 Members and 1 Guest are viewing this topic.
satyr
Newbie
*
Offline Offline

Posts: 41



View Profile
« on: February 18, 2011, 03:06:49 PM »



I want to analyse Malware behavior. the best bet would be VM
But I have read about malwares capable enough to break out of the VM environment. Has anyone faced such issues or is it just a theory ?

Is it possible for Netbooks (with atom processor at least) to run multiple VM ? i feel that is a safe way to analyze malwares as i can have a cheap netbook just for that purpose.

comments and suggestions highly appreciated
Logged
ziggy_567
Sr. Member
****
Offline Offline

Posts: 302


View Profile
« Reply #1 on: February 18, 2011, 07:48:49 PM »

I wouldn't worry so much about processor as I would memory for running VMs.
 
Anyway, you can use a netbook, laptop, desktop, etc. to run your VMs. If you're worried about jumping to the host OS, just make sure wireless is disabled and there's no physical connection otherwise, and you're good.

What I've heard more than VM escapes with malware is behavior modification based on whether or not the infected machine is running in a virtualized environment.

Good luck!
Logged

--
Ziggy


GSEC - GCIH - GCUX - RHCE - SCSecA - Security+ - Network+
SephStorm
Sr. Member
****
Offline Offline

Posts: 416


View Profile WWW
« Reply #2 on: February 19, 2011, 10:44:48 PM »

I would advise researching samples before you download, seeing if there are any clues that would indicate the malware is a jumper. in addition, you could keep separate hard drives, one specifically for testing with the malware VM's, so even if it does jump it cant effect any sensitive data.
Logged

satyr
Newbie
*
Offline Offline

Posts: 41



View Profile
« Reply #3 on: February 25, 2011, 02:51:41 PM »



thanks SephStorm  and  ziggy_567 .. i will dig up about this and see what is the best way to go

thanks a lot Smiley
Logged
nixfreak
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #4 on: March 27, 2011, 01:56:28 PM »

You can run a vm on a atom processor but it has to have at least 2 gigs of ram , you can do it on 1gig but its really laggy and doesn't respond very well.

Try using Qemu though instead of virtbox or vmware.

Logged
WCNA
Full Member
***
Offline Offline

Posts: 182



View Profile
« Reply #5 on: March 27, 2011, 04:56:41 PM »

I'd look into using deepfreeze along with the sandboxie/bsa combo.
Logged

ISC2 Associate, WCNA, CWNA, OSCP, Network+
hayabusa
Hero Member
*****
Offline Offline

Posts: 1304



View Profile
« Reply #6 on: March 27, 2011, 05:14:26 PM »

Yeah...  Deepfreeze and sandbox'ing are good ideas.  I personally just keep backed up copies of my various VM's and snapshots, on dvd's for easy restoration.  Regardless, it's all about time and convenience, as well as ease of baselining.
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
WCNA
Full Member
***
Offline Offline

Posts: 182



View Profile
« Reply #7 on: March 27, 2011, 05:30:18 PM »

You could also take a look at the Table of Contents for the book "Malware Analyst's Cookbook"
http://www.amazon.com/gp/product/0470613033

It's got most of the open source and free tools listed.
Logged

ISC2 Associate, WCNA, CWNA, OSCP, Network+
SephStorm
Sr. Member
****
Offline Offline

Posts: 416


View Profile WWW
« Reply #8 on: March 28, 2011, 02:16:19 PM »

Where did that book come from?  Shocked
Logged

hayabusa
Hero Member
*****
Offline Offline

Posts: 1304



View Profile
« Reply #9 on: March 28, 2011, 03:18:42 PM »

Don't have that one...  New item for wife's Father's Day list...
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCP , GPEN, C|EH
satyr
Newbie
*
Offline Offline

Posts: 41



View Profile
« Reply #10 on: June 16, 2011, 12:09:29 PM »

Has anyone used Cloud services like Amazon for the purpose of malware analysis.
Its a really good option as there is no need to invest in a hardware.
But is it okay to deliberately infect an instance on cloud just like we do it on vm and revert it back ?

I do not know much about this, please shed light on this topic
Logged
AndyB
Full Member
***
Offline Offline

Posts: 100



View Profile
« Reply #11 on: June 18, 2011, 05:12:19 PM »

I know a guy called Thomas Roth used the Amazon Cloud to crack wpa-psk network initially in under 20 mins but he refined that down to about 6 mins.

Amazon got the hump with him a little and were quoted at the time as saying

using the cloud service to create a tool to show how security can be increased is okay. But don’t use it to actually crack passwords:

Would probably want to speak with them first before hiring their hardware
Logged

Net+ Sec+ More to come
cd1zz
Sr. Member
****
Offline Offline

Posts: 393


View Profile WWW
« Reply #12 on: June 18, 2011, 05:43:17 PM »

I think this is probably against their TOS. I know if you want to use the Amazon Cloud to do a pentest, you have to get authorization before you start. To analyze malware  you'll likely allow it to propagate if it has those capabilities so I would guess they wont let you do it. I would just use a local VM environment. If you're extra worried about it breaking out of the environment, use a separate box with nothing important on it.
Logged

3xban
Sr. Member
****
Offline Offline

Posts: 373


View Profile
« Reply #13 on: July 10, 2011, 11:33:30 AM »

I am in a similar boat.  I will actually be starting a new job and one of the projects will be to setup a malware analysis lab.  My plan will be to use a separate ESX host, fully segmented/isolated from the production network.  Build the victim systems and snapshot the whole lot. 

Thanks for the book recommendation, going check out the kindle sample and most likely purchase it depending on the content.  Sometimes technical books don't translate well to kindle.  But you can at least download the DVD contents using an SVN client and grabbing the google code repository. 

I also used the following site to gather certain tools for this job: http://zeltser.com/malware-analysis-toolkit/ there are some additional links to certain specifics.  For my home lab I will probably be converting my present Desktop to an ESX host once I get my new system.  Install a 2nd NIC for management of ESX and utilize the other for the VM network or just setup my laptop to manage it therefore still keeping it fully isolated from the home systems.
Logged

Certs: GCWN
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.189 seconds with 22 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.