So the first thing we're concerned about is we're dealing with a live malware,
right? We have something‑‑‑or something that we think is my live malware,
and we want to detonate it inside a real environment. Yes.
So how are we making sure that we're not infecting other
systems, not infecting our system, or the main system we're using?
How we quarantining?
So the way that we're going to do that is we use virtual machine software.
Now virtual machine software allows you to run a second operating system
underneath what's called your host OS. And the great thing about virtual
machines is you have a complete operating system,
a complete computer within another computer that you can do
whatever you want to. The best thing about virtual machine
software is called snapshots.
Snapshots allow you to take basically a picture of the operating
system or that guest OS at a point in time.
And what that does is it allows you to set up your system in a certain
way and then save it so you can immediately jump back to that point in
time and immediately begin your analysis.
If you infect your virtual machine with a specific piece of malware, you
can snapshot that at certain points in time, or even if you want to
install specific pieces of software, let's say you want to do analysis on
document malware, you might install Office 2010 in one snapshot and then
Office 2016 in another and then the Office 365 version in a third one.
Snapshotting each of these allows you to jump to all those different
pieces of software without having to go through and reinstall it each
time.
It just makes analysis much, much faster.
It's not just for quarantine.
It's also for software versioning and discovering how that's going to work in
different environments. Right, and you might find that malware works
differently when different software is installed or when different patch levels
are set up or different settings are available.
And so you may want to have all those readily available to you
so you can kind of jump in and see how things work. So it's the
same base machine, same base OS, one license of (inaudible). Yeah, honestly,
you don't even need to go out and buy a license of
Windows or a new version of Windows.
There are free versions that you can download from Microsoft,
they're time limited, but you can download them,
set them up, snapshot them, and always kind of revert back to them.
Absolutely. With the snapshotting, is that vendor specific,
or is there any benefit in certain snapshots with VMWare versus
VirtualBox versus Hyper‑V or anything like that?
So most of the major virtual machine software packages like
VMWare and VirtualBox, they support snapshotting.
You just want to make sure that whatever you choose,
that it does support snapshotting.
So VMWare, for example, has a number of different packages.
There's VMWare Workstation.
There's VMWare ESX. There's VMWare Player.
All those except from VMWare Player support snapshotting.
So you want to make sure that whatever you use works with that, has that
ability for you to go in and do the snapshots because it is very important
because, otherwise, you're going to be going in and reinstalling everything
every single time, and it's just going to slow down your analysis process.
When you do those snapshots, it's actually creating a change disk that adds on
to the main file‑based hardware disk for that virtual machine, correct? Is
there any analysis because those changes‑‑‑say you take a snapshot and then
detonate the malware and then use that change disk as what has changed on the
device. Is there any analysis that's available to use that change disk as an
identifier for what's changed since you detonated malware?
There are. There are a number of different tools that you can use
to kind of look at the changes between the snapshots that you've
made, and it does allow you to go in there and take multiple
snapshots as you go through.
But some of the tools that we're talking about will actually just make
it a little bit easier for us to do it on the fly.
Okay, great.
So we're not just relying on the snapshots as a picture
for what happened before or after.
We're going to have other tools that we use for
analysis as well, right? Exactly.