Virtual machines are great. If you are unfamiliar with them, they allow you to literally emulate an entire operating system (or even a network, if you wish). Every detail of these virtual machines have the same traits as a regular system all the way down to the IP address. These virtual machines can be used for anything, but they are mostly used to run and analyze malware. Hackers obviously don’t like this, so they are directing their attacks against the virtual machines.

Hackers are adding virtual machine detection to their worms and Trojans to stymie analysis by anti-virus labs, a security research said Sunday.

The tactic is designed to thwart researchers who use virtualization software, notably that made by VMware, to quickly and safely test the impact of malicious code. Researchers will often run malware in a virtual machine to protect the system’s actual operating system from infection; virtualization software also lets analysts test malware against multiple operating systems on a single computer.

“Three out of 12 malware specimens recently captured in our honeypot refused to run in VMware,” said Lenny Zeltser, an analyst at SANS Institute’s Internet Storm Center (ISC) in an online note Sunday.[more]

Tags: Hackers