Ideal (Safe) Virus Removal Practice Environment?

[Vicenarian]

Ok, so let's say a person wanted to practice removing various malware, by creating a VM and infecting it, then removing the malware. Now, for this to be safe, we have to take some things into consideration.

The main thing I'm worried about is this...worms (and other malware I guess) can spread throughout a network (somehow)...so basically I'm thinking a worm in a guest Virtual Machine could theoretically spread via the host machine's virtualized network adapter (In virtualbox, being the "VirtualBox Host-Only Ethernet Adapter" driver), and then into your home/business network, infecting other computers, which would be very, very bad. I'm no networking expert, so that's why I need some help. How can this be prevented? What steps can a person take to quarantine (as much as possible) malware to a guest OS, and not let it spread to the host and it's network?


Here's my take on it, feel free to add/remove/edit anything:

1. Set up a dedicated Linux host machine with no windows partitions (entirely Linux, so in case malware somehow escapes the Virtual Machine, it won't do damage/infect the host machine itself and/or any windows OS located thereon).

2. Connect the host machine physically to a hardware firewall and then to a router??? Set up settings on the router/firewall???

3. Make sure all "shared folders"/"guest additions" etc. and other unsafe features are disabled in the virtualization software.

4. Install a software firewall on the shared virtual network connection between the host and guest OS. (Like in Virtualbox, a "VirtualBox Host-Only Ethernet Adapter" driver is installed on the host machine, so the guest OS can receive network connections)

5. Invest/use a router that is not vulnerable to "router worms" (Worms that can infect routers and spread across your network) I have no idea how this works, how feasible this is, nor how important this step is. Just throwing out ideas.



Anyway, those are my newbie ideas. Please add whatever input you can, as having a sort of standard procedure in creating a safe malware testing environment would be a great asset to many, I am sure.

 

[vdub12]

I use virtualbox and I have released some real nasty stuff on it.

I usually just set the network adapter up as NAT. I haven't had a problem yet. Then again aside from two computers my network is almost entirely Linux.

 

[iisjman07]

I use VirtualBox too and have never had any problems, mind you my OS of choice is linux so it wouldn't matter anyway

 

[Vicenarian]

I see, well yeah, my worry is because I have other Windows computers on my home/business networks, and I don't want them getting infected.

 

[hyfidel]

VMWare and Virtualbox will both let you disable the network adaptor in the settings.

 

[Vicenarian]

VMWare and Virtualbox will both let you disable the network adaptor in the settings.

But then how do you get infected? I mean, yeah I could download some malware and put it onto a usb stick or CD or something, but if it's disconnected from the network, you might not be seeing the full power of the malware, (e.g. malware that downloads other malware/connects to a remote server to do things) etc.
Sorry, I have no clue, just speculating.

 

[iisjman07]

^^

You can enable the network before saving the malware, then disconnect and execute the malware.

 

[Stormy]

All i did was install virtualbox, install my os (WXP) and then start infecting it. My host was never infected and i had some really bad stuff on it. TDSS is very annoying to say the least.

Just having a random guess here, but if you had a good firewall, like Comodo on every computer in your network would it still be able to spread through networks?

Oh and whats the big deal about getting infected? You should have your backup and os cd's.

 

[Vicenarian]

All i did was install virtualbox, install my os (WXP) and then start infecting it. My host was never infected and i had some really bad stuff on it. TDSS is very annoying to say the least.

Just having a random guess here, but if you had a good firewall, like Comodo on every computer in your network would it still be able to spread through networks?

Oh and whats the big deal about getting infected? You should have your backup and os cd's.

Well, I don't want customer's computers to get infected. All my own machines are heavily secured and use Comodo firewall.

 

[kagman]

Use Virtualbox to create a virtual machine, or even Virtual PC 2007 from Microsoft. Both programs are free and work great for testing out viruses and stuff..

 

[ATTech]

But then how do you get infected? I mean, yeah I could download some malware and put it onto a usb stick or CD or something, but if it's disconnected from the network, you might not be seeing the full power of the malware, (e.g. malware that downloads other malware/connects to a remote server to do things) etc.
Sorry, I have no clue, just speculating.

If you happen to come across a piece of malware that does utilize the network, you would want to be disabling any network connections anyway.

 

[MobileTechie]

Nothing is going to jump out of the VM onto the host. The danger is networking or shared folders.

Other than that, a VM is like any other machine. If you network them then some worms can travel across the network but are stopped by firewalls just like in a physical setup.

If you don't want customer machines (which might not have firewall configured correctly) to be at risk (as tiny as that is) then simply don't have them connected to the VM whilst it's running.

Don't rely on a s/w firewall on the VM since clearly malware could turn it off or at least open a port.

 

[ProTech-MN]

The easiest & probably safest approach is to simply configure separate VLAN's for both your business network and your test machine/network or your VirtualBox guest OS's. The VLAN will be completely isolated - NO chance of any infection from your test network/machine.

I actually like to keep client computers on a separate VLAN as well... keeps all my business systems isolated from any repair or testing networks... It's just not worth even the slightest risk to my business systems to even attempt anything that may cause any kind of problem.

Of course, you'll need VLAN capable network equipment.. a smart switch at least, but it's handy if you're firewall supports VLAN's too. For about ~$100 you can get an 8 port Netgear gigabit switch (GS108T) with VLAN support...

-Randy

 

[Vicenarian]

The easiest & probably safest approach is to simply configure separate VLAN's for both your business network and your test machine/network or your VirtualBox guest OS's. The VLAN will be completely isolated - NO chance of any infection from your test network/machine.

I actually like to keep client computers on a separate VLAN as well... keeps all my business systems isolated from any repair or testing networks... It's just not worth even the slightest risk to my business systems to even attempt anything that may cause any kind of problem.

Of course, you'll need VLAN capable network equipment.. a smart switch at least, but it's handy if you're firewall supports VLAN's too. For about ~$100 you can get an 8 port Netgear gigabit switch (GS108T) with VLAN support...

-Randy

Ah, exactly what I am looking for, thanks!