Войти в систему
Войти с помощью соц. сетей:
Before you can run malware to perform dynamic analysis, you must set up a safe environment. Fresh malware can be full of surprises, and if you run it on a production machine, it can quickly spread to other machines on the network and be very difficult to remove. A safe environment will allow you to investigate the malware without exposing your machine or other machines on the network to unexpected and unnecessary risk.
You can use dedicated physical or virtual machines to study malware safely. Malware can be analyzed using individual physical machines on airgapped networks. These are isolated networks with machines that are disconnected from the Internet or any other networks to prevent the malware from spreading.
Airgapped networks allow you to run malware in a real environment without putting other computers at risk. One disadvantage of this test scenario, however, is the lack of an Internet connection. Many pieces of malware depend on a live Internet connection for updates, command and control, and other features.
Another disadvantage to analyzing malware on physical rather than virtual machines is that malware can be difficult to remove. To avoid problems, most people who test malware on physical machines use a tool such as Norton Ghost to manage backup images of their operating systems (OSs), which they restore on their machines after they’ve completed their analysis.
The main advantage to using physical machines for malware analysis is that malware can sometimes execute differently on virtual machines. As you’re analyzing malware on a virtual machine, some malware can detect that it’s being run in a virtual machine, and it will behave differently to thwart analysis.
Because of the risks and disadvantages that come with using physical machines to analyze malware, virtual machines are most commonly used for dynamic analysis. In this chapter, we’ll focus on using virtual machines for malware analysis.
Войти с помощью соц. сетей: