Hi, lately I have been learning about RE (Reverse Engineering) and now I would like to move to malware analysis. Obviously I want to make this the most secure way possible.
My first thought was to do this: DisposableVM cloned from a Win10 template with the necesary tools > This DisposableVM would be connected to a custom NetVM which has tools like tcpdump and wireshark and this NetVM would tunnel the traffic trough a proxy or a VPN and also would have sys-net configured as net qube. The NetVM would obviously have a bunch of firewall rules and other security features. I would like to see if anyone more technical or someone that already did something similar could give me more ideas or improvements on this setup. Thanks!
You do not need a custom NetVM unless you want to record live network traffic, you can simulate network activity instead and change the DisposableVM to be air-gapped by default. If you still want the NetVM, you can separate its concerns into multiple qubes and chain through them instead, so that full compromise of one qube does not immediately lead to compromise of others. You may want to be careful about using QWT, because malware can potentially use it as a vehicle for inter-VM integration that could escape the guest qube.
One extra safety layer I would add is to keep two modes: an offline disposable for static RE, and a separate, clearly named networked disposable only when you intentionally want traffic. For the networked one, make the NetVM capture-only as much as possible and block LAN/private ranges, not just rely on a VPN. Also snapshot/export the sample and notes before running it, because disposable state disappearing is useful for safety but annoying for reproducibility.
It is depends on what is your goal…
I would setup a transparent suricata in a proxyVM (not sure what is the current term for this), where you can monitor/log all the network activity of your ‘potentially malicious’ AppVMs.
BUT:
in real life, malware are working differently if running in a VM. Some of them are simply not ‘activating’ itself at all.
it might break out from the VM isolation, so I would not mix with private/valuable environments, but dedicate a separate laptop for this.
Qubes OS is not specifically designed for such use case.
There are some issues with this approach. First some vm signs can’t be get rid off even if you will manage to make the vm very convincing looking bare metal install. Namely manipulation of raw packets has big issues. I don’t know if it’s possible to solve them. Secondly if you really care about safety and if you want to use it on the same machine you do your banking, taxes and other real life activities you should look into nested virtualization. It’s way harder for malware to break out of vm if it is inside another vm which is virtualized differently. For example you may have windows 10 inside bhyve hypervisor running on freebsd which is inside xen hypervisor running linux. But the performance will be extremely bad