news.volyx.in

I made my VM think it has a CPU fan (wbenny.github.io)

679 points by todsacerdoti · 395 days ago · 188 comments on HN

Article summary

The article discusses how to make a virtual machine (VM) think it has a CPU fan, which is a common check used by malware to determine if it is running in a virtual environment. The author explains how to set custom SMBIOS data in Xen and QEMU/KVM to fake the presence of a CPU fan. This is done by creating a file with the SMBIOS data and configuring the VM to use it. The goal is to make the VM appear as a physical machine to the malware, allowing it to run without detecting the virtual environment.

Main themes

  • Virtualization security
  • Malware detection
  • SMBIOS data
  • SR-IOV
  • Capability-based operating systems
  • Code signing certificates
  • Trusted software lists
  • Hardware acceleration
  • Performance vs security tradeoffs
  • Malware evasion techniques

What commenters say

  • Running software in a VM can provide security benefits, but may also have drawbacks such as reduced hardware acceleration.
  • Malware authors may use various checks, including SMBIOS data, to detect if they are running in a VM, but these checks can be detected and flagged as suspicious by AV software.
  • Using SR-IOV and other virtualization technologies can provide a balance between security and performance, but may also introduce new security risks if not properly configured.
  • Relying on static analysis of system calls to detect malware can be ineffective and may lead to false positives or negatives.
  • Some commenters argue that the use of VMs and virtualization technologies can provide a false sense of security, and that a more effective approach would be to use a capability-based operating system.
  • Others argue that the benefits of virtualization, such as hardware acceleration and improved performance, outweigh the potential security risks.
  • The use of code signing certificates and trusted software lists can help to mitigate the risk of malware, but may not be foolproof.
  • The effectiveness of malware detection methods, such as timing checks and SMBIOS data analysis, can be limited by the variability of real-world hardware and the ability of malware authors to adapt and evade detection.