Is the latest ransomware able to bypass VirtualBox?

I have tested and analyzed dozens of ransomware in VirtualBox, and none of them has infected my host.
The important thing is not to activate the shared folders.
Everything is possible, but objectively I do not have experience of evasions.
 
  • Like
Reactions: DardiM, Logethica, Der.Reisende and 5 others
Klipsh said:
I have tested and analyzed dozens of ransomware in VirtualBox, and none of them has infected my host.
The important thing is not to activate the shared folders.
Click to expand...

Shared Folders can be activated but it must be protected then by other tools. (sandbox, anti-exe, folder lockers, etc...)

Kalashnikov said:
what about ransomware locking the MBR sector ? :).
Click to expand...

It will encrypt the guest's MBR not the Host one.

.
 
  • Like
Reactions: Logethica, DardiM, Der.Reisende and 3 others
Virtualbox contains so far the full proof of strong virtualization, which is not easy to bypass. (The chances of another new vulnerability is possible)

As you can see, the settings [Virtualbox] are all disabled per default so make sure that shared folder must monitored regularly to avoid any incidents.
 
  • Like
Reactions: DardiM, Logethica, Der.Reisende and 1 other person
Update

During my last tests, some generic malware have recognized Vitualbox checking for the presence of the guest additions drivers.

Malware "could" escape the environment of the virtual machine: in the case of a host only network, any bugs present in the host network driver or in the host sevices that can be exploited through the sending of packages specially created, or exploiting bugs (for example, unchecked inputs).

It is always necessary to use the latest version of any VM (VBox and VMWare).
 
  • Like
Reactions: Der.Reisende, harlan4096, Logethica and 2 others
You must log in or register to reply here.

You may also like...