Safe Networking for virus testing?

[WhiteZero]

I want to start testing anti-viruses on a virtual machine (VirutalBox). Will I be save enough from cross-contamination with NAT networking? Or should I bridge the connection, or even use the 2nd physical ethernet port on my computer just for the virtual machine?

 

[berky]

how are you going to "test" the anti-viruses?

 

[lopoetve]

what berky said

 

[MrGuvernment]

you would want a completely separate from anything important network, just have the computer on it's own, not even connected to a network and use a usb key or something to transfer over viruses..

 

[WhiteZero]

how are you going to "test" the anti-viruses?

Loading the VM with an antivirus and loading malware to see if it can catch them.
Thats not really the issue here though.

 

[Dr.Pants]

you would want a completely separate from anything important network, just have the computer on it's own, not even connected to a network and use a usb key or something to transfer over viruses..

VMs generally won't transfer around viruses, IIRC, unless you have some special features enabled. BUT, like MrGuvernment said, if you're going to test this sort of stuff, you need a separate computer. For instance, the NetSec people at UAT have their own lab for this sort of stuff that isn't networked to anywhere in else on-campus, much less out of that room, as something particularly nasty could come out of it, since they infect machines with particularly nasty pathogens so future career admins can get the training they need.

Since you're going to play with fire, I suggest that you do it in an isolated environment. I'm not trying to sound paranoid or anything, but one never knows.

 

[WhiteZero]

Since you're going to play with fire, I suggest that you do it in an isolated environment. I'm not trying to sound paranoid or anything, but one never knows.

That what I was hoping the VM would provide.
I posed this question on the VirtualBox forum, and most people agree I'm safe with NAT and no shared folders or anything with my host PC.

 

[Dr.Pants]

You should be safe, as long as the malware's behavior that you are using is known.

 

[number69]

nm.

 

[jrdonnaruma]

What Dr. Pants said about testing in a lab is very true, you really want a separate system for testing. But, if you are short on resources, using a virtual instance without networking isn't a bad idea, or NAT if you must have network access.

Personally, I have my own separate lab connected only through a switch to the internet outside of my network firewall, so my private network is completely shielded from any testing going on in my NetSec lab (an idea i took from my time at UAT, actually.)

Have fun and good luck with your testing. If you have any questions, drop me a PM.

 

[Scotch77]

I didnt know UAT was a serious school, when I went to university for the first time I looked into that place. Sorry to day but 7 years ago the place looked like a video game school. Im glad to see it had some potential.,

Im interested in what the curriculum entailed, if anybody wants to elaborate.


sorry for thread hijack.


Though to be honest your best bet is to do this

Create a mint install of the os of your choice in virtualbox, make sure it is up to your standards. Now shutdown and copy the image to some other location. Now if you botch the system you can just copy the perfect copy and write over the infected.

When you go to load the virus, I suggest you simply disable the network link which is easy enough to do. Now all you need to worry about is the virus having the ability to leave the address space of virtualbox. Im not a windows programmer so I am not familiar with windows particulars.