The first question I have is should I be using a Windows device
and then virtualizing a Windows VM on top of that? Is that more
or less dangerous than maybe using Mac or using like a Red Hat
Linux or something like that?
So I would say that if you have the ability to do it to have your host OS be
different than your guest OS. So in other words, if you're running a Windows
virtual machine and you're going to be running Windows malware within it, use
Linux as your host OS or use Mac as your host OS, and the reason I say that is
because it's less likely that malware is going to break into your host OS that
way from across the virtual network that we'll be setting up or something like
that.
So think of it like this. Worst case scenario,
if your malware that you're analyzing has some zero‑day exploit in it
against Windows that you're running on a Windows OS virtual machine,
and your host OS is also Windows, then there's always a chance that it
could break into your host OS that way depending on how your network
settings are set up.
If you have a Mac host OS and a Windows Guest OS,
it's less likely that malware is going to be cross OS compromising.
There is malware that does that. They're pretty rare,
but there's always that possibility.
But if you have the ability to do it,
if you have a Mac or you understand how to use Linux and
you're comfortable with using Linux, I would recommend doing that when you can.
Absolutely.
And I was going to get into the various malware. So it's compiled,
malware is compiled for a specific operating system,
right?
Yes. So if you're getting a Windows X86 executable, it's
not likely going to be compatible to, In fact,
over‑the‑network a Mac OS. Right. Now, remember,
too, that when you get into things like .NET programs,
those are compiled into byte code that could be run
on multiple operating systems.
It's the same thing with Java. A piece of Java malware could technically
run on Windows, on Mac, on Linux as long as that Java interpreter is there.
And the same thing even now with PowerShell. There're PowerShell
interpreters for Windows and Mac and Linux.
So, technically, there could be PowerShell malware that if you
have the right stuff set up on your host OS that it could also,
the malware could still run there.
And that just kind of goes back to I think what we said that your host OS,
you still have to lock it down,
and you still have to assume that it could be compromised at some point.
So don't use your corporate laptop for this. Don's use
something that has important files on it,
especially if you're using something, if you're analyzing something like
ransomware. If somehow that gets out and starts encrypting your host OS, you've
just lost all your files there. Right, and that's something that's made to
spread too, so don't be connected to your corporate network. Absolutely not, no.
Have a separate network segment that you're doing this on. One of the great
things to do is have a separate wireless network that your virtual machine is
connected to or your host OS is connected to. Have one of those little MiFi
devices that you can jump on a cellular network or even just going through your
cell phone and setting up to be a hot spot that you can turn on and off really
fast will allow you to have internet access for your virtual machines that the
malware can access if you want it to, but it would still keep it away from all
of your other systems. That's a great note.
So maybe even just as a kind of general rule, if you're looking at
something that you think might have an interpreted language that's
being compiled there, then that's where it's a little bit more
dangerous for cross OS contamination,
as opposed to something that's been compiled into a
lower‑level language executable. Yes.