How do professional hackers to test their own malwares/viruses without harming their own computer?

Question

Yesterday I started some hacking tutorials on http://xeushack.com/tutorials/ by curiosity. I used the Android app to read the different articles about different ways of "hacking". The author clearly stated that some of them shouldn't be reproduce because they would basically harm the computer, such as the famous Zip bomb and Fork bomb or even Folder blaster.

So, I'm wondering what would be the best way for me to reproduces these "malwares" without doing harm to my own computer. But I'm also interested of finding a way that I could use for many different kind of malware/virus testing/development.

The first solution that comes to my mind is to use a Virtual Machine, so I could take a snapshot of the VM once installed and do whatever on it without harming the real OS. But I don't know for sure if this is the best solution and even if it's gonna work or not. I guess it would, but that's a guess.

Answer 1

How do professional hackers to test their own malwares/viruses without harming their own computer?

Almost all malware, if not all, works by obscurity. Once you understand how it works, and you have the appropriate skill-set, you can defeat it quite easily. If it's your own malware and viruses, then it's really quite simple: you know exactly what your malware does, and how to defeat it, correct? After all, you programmed it.

While yes, I agree in general with the use of a Virtual Machine, it isn't 100%. Nothing is 100%. You can infect your own machines, whether they're online or offline, and do interesting things with them.

You can observe how the malware interacts with your environment through many different methods. Here are some notable examples:

1. Observing all changes to the file system, and/or hard drives.
2. Observing memory
3. Debuggers such as OllyDbg, or IDA Pro.
4. Network packet-capturing tools such as Wireshark.

Disable the Virtual Machine's internet connection for best results

While others talk about malware "possibly escaping" the Virtual Machine, it isn't very likely, though it is possible. Even if the malware could detect that it's running inside a virtual machine, that doesn't help much unless the malware self-destructs upon detecting a virtual environment.

Even if a VM isn't detected, a piece of malware could simply try to escape it by assuming it may be there. So methods to prevent the malware from detecting it's inside a VM may not work, unless it's the type that self-destructs when detecting it.

Regarding the "attacks" you've mentioned, let's take a look at the results of them, assuming you can remove the infections:

1. Zip bomb
   • A zip bomb, also known as a zip of death or decompression bomb, is a malicious archive file designed to crash or render useless the program or system reading it. It is often employed to disable antivirus software, in order to create an opening for more traditional viruses.
   • After removing the infection, the left-behind zip-bomb can be nullified by deleting the files. If you made this yourself, simply make a cleanup routine. If you didn't make it yourself, simply make a cleanup routine. If the program is still forcibly running, you can reboot.
   • Won't cause physical problems with your hardware.
2. Fork bomb
   • In computing, a fork bomb (also called rabbit virus or wabbit) is a denial-of-service attack wherein a process continually replicates itself to deplete available system resources, causing resource starvation and slowing or crashing the system.
   • Won't cause physical problems with your hardware.
3. Folder blaster.
   • Same concept as the zip bomb, but with folder spam. Just write a routine to delete them.
   • Won't cause physical problems with your hardware.

Better yet, if you have a virtual testing environment, you can delete these automatically by saving the state of a virtual machine before the infection, and restoring it after you're done studying the output. This is the easiest, most efficient method by far.

Answer 2

Depending on how the malware works, virtualization might be a sufficient way to contain it. By running the malware in a virtual machine, it can only cause damage inside the virtual machine and only use up those resources which are assigned to it.

However, there is also malware which either does not work inside a VM or is dangerous even when used in one. In that case the only way to test it is by using spare hardware.

Answer 3

Some malware has the ability to recognize when its virtualized and attempt to "think outside the box" using the most interesting of tactics I've seen...sometimes even trying to control the keyboard. The only way to truly test them is to set up an airgapped laptop or desktop and run it on that, then reinstall all the OS when you're done...time consuming but the only "safest" bet.