L
LabZero
Thread author
I read old post about this question but it is possible that a new malware can bypass Vbox ?
I read old post about this question but it is possible that a new malware can bypass Vbox ?
Have you tried Shadow Defender yet if not you get a 30 day free trial at this link. http://www.shadowdefender.com/
Not saying it can't but have not seen any proof that it can either.There are 2 ways to achieve VM escape with virtualbox.
The first is configuration errors, which others have mentioned above. The second, which is potentially far more serious is a vulnerability in VirtualBox itself. An example would be CVE-2014-0981, which allows malware in the VM to escape into the host system. However, you do not need to worry about such exploits because to the best of my knowledge no malware has such a capability. Not even APTs.
Shadow defender is a nice addition, but it is also far from full-proof. If i recall correctly a year back there were issues reported about how Shadow Defender failed to protect against some advanced rootkits. Furthermore, although I have not tested it personally, I do not see any reason why kernel level exploits and malware are not able to bypass Shadow Defender. At this privilege level malware can unload most if not all security software and do whatever it wants.
Lol never tried that but interesting.One solution would be to use Sandboxie in Shadow Defender (sandbox in sandbox)
Shadow defender is a nice addition, but it is also far from full-proof. If i recall correctly a year back there were issues reported about how Shadow Defender failed to protect against some advanced rootkits. Furthermore, although I have not tested it personally, I do not see any reason why kernel level exploits and malware are not able to bypass Shadow Defender. At this privilege level malware can unload most if not all security software and do whatever it wants.
One solution would be to use Sandboxie in Shadow Defender (sandbox in sandbox)
Never got by on my Windows 7 system either and i have tried very hard to breach it.In the video, the tester used Kaspersky TDSS Killer. TDSS picked up a remnant at the very end of Track 0. However, the tester did not realize it was a remnant and reported it as a complete rootkit by-pass.
Tony fixed this issue.
I'm not saying Shadow Defender is "bullet-proof." As in its current version there is no complete disk virtualization...which is a request submitted to the developer.
If there is any current vulnerability with Shadow Defender then it is strictly limited to rootkits...and no testing has established this to be the case since Tony coded complete MBR virtualization. Based upon my experience nothing has, so far, gotten past it on my W8.1 system...and that's a lot of malwares.
I've been trying to track-down some samples of Zero Access/Sirefef and other rootkits for some testing. It's about time that the Shadow Defender 0 rootkit question is definitively answered: "Can rootkits bypass it or not?" And the tests need to be credible. There's no use in doing the testing if it isn't beyond reproach... like what happened to that unfortunate video author.
If anyone can be of assistance in providing W8 executables then it would be a great help.
We were just joking around about that.Double-sandboxing will not prevent an exploit.
Bromium researches used Sandboxie inside a VM and the exploit still managed to pull off its dirty deed.
We were just joking around about that.
After Privdog i am not touching Comodo ever again period.
In the video, the tester used Kaspersky TDSS Killer. TDSS picked up a remnant at the very end of Track 0. However, the tester did not realize it was a remnant and reported it as a complete rootkit by-pass.
Tony fixed this issue.
I'm not saying Shadow Defender is "bullet-proof." As in its current version there is no complete disk virtualization...which is a request submitted to the developer.
If there is any current vulnerability to malware with Shadow Defender then it is strictly limited to rootkits...and no testing has established this to be the case since Tony coded complete MBR virtualization. Based upon my experience nothing has, so far, gotten past it on my W8.1 system...and that's a lot of malwares.
However, if anything is going to handily defeat SD it is going to be an exploit and not a run-of-the-mill nasty.
I've been trying to track-down some samples of Zero Access/Sirefef and other rootkits for some testing. It's about time that the Shadow Defender 0 rootkit question is definitively answered: "Can rootkits bypass it or not?" And the tests need to be credible. There's no use in doing the testing if it isn't beyond reproach... like what happened to that unfortunate video author.
If anyone can be of assistance in providing W8 executables then it would be a great help.
If I have time I will dig through my sample collection and make a test.