Ingabe kuphephile ukuhlola uhlelo olungayilungele ikhompuyutha emshinini obonakalayo? Umhlahlandlela osebenzayo kanye nemikhawulo

Zama I-malware Ngaphakathi komshini we-virtual kuzwakala njengombono ohlakaniphile: indawo engayodwa, enenkinobho engemuva futhi engenayo imiphumela… noma ingabe kunjalo? Impendulo emfushane ithi yebo, ingavikeleka, kodwa kuphela uma uqonda imingcele yokuzihlukanisa futhi usethe ilebhu yakho ngokuhlakanipha.Uma ukwenza kancane, kunengozi yokuvuza kumphathi wakho noma inethiwekhi yebhizinisi.

Lesi sihloko sihlanganisa futhi sihlele, ngamagama acacile, lokho okushiwo imithombo ehlukahlukene yereferensi mayelana nokwenza izinto ezibonakalayo, ukuphepha, nokuhlaziywa kwesampula. Uzothola indlela yokunquma ukuthi uyikhwezwa kanjani, tricks Amathiphu okuxhumana okugwema ukwenza amaphutha, amathuluzi anconyiwe futhi, okubaluleke kakhulu, lapho i-VM inganeleUmqondo wukuthi ugcina usunesu elingokoqobo nelihlakaniphile, elingenazo izinganekwane.

Uyini ngempela umshini obonakalayo futhi kungani usiza ngohlelo olungayilungele ikhompuyutha?

Umshini obonakalayo (i-VM) empeleni “ikhompyutha engaphakathi kwekhompyutha yakho,” eqhutshwa i-hypervisor eyabelana nge-CPU yekhompyutha engumsingathi, inkumbulo, isikhala sediski, kanye nenethiwekhi. Ukusuka ngaphakathi, i-VM iziphatha njenge-PC ephelele enesistimu yayo yokusebenza, izinhlelo zokusebenza, nehadiwe ebonakalayo.Lokhu kwehlukaniswa okunengqondo kunikeza izinga lokuqala lokuqukatha ukuze kuhlolwe isofthiwe engabazekayo.

Kunezindlela ezimbili ze-virtualization okufanele zihlukaniswe: imishini engokoqobo cubungula imishini ebonakalayo (njenge-JVM) ehlinzeka ngendawo yokusebenzisa izinhlelo ezithile, kanye nemishini ebonakalayo yesistimu, elingisa lonke uhlelo lokusebenza. Ukuhlola uhlelo olungayilungele ikhompuyutha, sinentshisekelo kuma-VM esistimu, ane-OS yawo yesivakashi, idiski, nesitaki senethiwekhi..

I-hypervisor (VMM) ilamula phakathi komsingathi ongokoqobo kanye nama-VM. VirtualBox, VMware I-Workstation/Fusion, i-Hyper‑V noma i-KVM izibonelo ezidumile ezikuvumela ukuthi usebenzise ama-VM amaningi ngesikhathi esisodwa futhi uphathe izinsiza lapho kudingeka khona.. Ezingeni elingokoqobo, uqala i-VM efasiteleni futhi usebenze njengokungathi enye ikhompuyutha.

Kungani lokhu kulusizo lapho uhlaziya uhlelo olungayilungele ikhompuyutha? Ngoba umonakalo, kuhle, uhlala "ukhiyiwe" ngaphakathi kwesivakashi. Uma isampuli ibethela amafayela, iguqule ukubhalisa, noma izama ukuqhubeka, izinguquko zithinta leyo ndawo, hhayi umsingathi.Futhi, ngezifinyezo, ungakwazi ukuhlehlisa isilingo esihlulekile ngamasekhondi.

Ingabe iphephile ngempela? Imikhawulo yokuzihlukanisa kanye nemikhuba engcono kakhulu

I-Virtualization iyasiza kakhulu, kepha ayiyona i-capsule engangeneki. Kunamasampuli athola ukuthi aku-VM, ashintsha ukuziphatha noma azama ukuphunyuka ngokusebenzisa ubungozi ku-hypervisor noma ukuhlanganiswa phakathi komsingathi nesivakashi.Akuvamile, kodwa kungenzeka, futhi kufanele siziphathe sengathi kungenzeka.

Ukuze kuncishiswe izingozi, kunconywa ukulungiswa kwaselabhorethri okuqinile. Okokuqala, dala i-VM, faka isistimu nezinsiza, bese uthatha isifinyezo "esihlanzekile" ukuze uthole ireferensi.Ngale ndlela, unephoyinti lokubuyela ngokushesha noma nini lapho okuthile kuthintwa noma "kungcolile."

Qaphela izinsiza ezixhuma isivakashi kumsingathi. Khubaza amafolda abelwe, ibhodi yokunameka izindlela ezimbili, hudula bese udedela, bese uxhuma ngokuzenzakalelayo USBKonke lokhu “kubhuloho” kuyivekhtha yokuvuza kwedatha noma ukwenza okungahlosiwe kumsingathi.

Mayelana ne-inthanethi, umgomo wokungabi namalungelo amancane uyasebenza. Uma ungakudingi ukufinyelela kunethiwekhi, yivimbe; uma uyidinga ukuze ubheke ukuhamba kwezimoto, kwenze lokho ngemithetho nezilawuli ezicacile.Ukuvimbela ukuxhumana endaweni "ethule" kakhulu kukusindisa umsindo futhi kunciphisa ukuchayeka.

Gcina isofthiwe yakho ye-virtualization isesikhathini samanje. Ama-patches e-Hypervisor alungisa amaphutha angase asetshenziswe ikhodi enonya ukuze aphule ukuzihlukanisa.Futhi khumbula: ungasebenzisi amasampula wangempela kukhompuyutha yakho enkulu noma ngama-akhawunti anezimvume ezingadingekile.

Amamodi enethiwekhi ku-VM: ungavuli kanjani kakhulu

Ukucushwa kwenethiwekhi kwenza umehluko phakathi kwelebhu ehlakaniphile nomnyango ovulekile ku-LAN yakho. Izindlela ezivamile i-NAT, i-Bridged, kanye ne-Host-only, futhi ngayinye inokubonakala nemithelela yokuchayeka..

• Imodi Yebhuloho: I-VM "iphuma" kunethiwekhi yakho njengokungathi enye ikhompuyutha, ene-IP/MAC yayo. Ikuvumela ukuthi uthole ukuxhumana okungenayo futhi ukhulume ngokuqondile nabanye ababungazi ku-LANIlungele ukukhiqiza kabusha izimo zempilo yangempela, kodwa futhi iyingozi kakhulu uma usebenza nohlelo olungayilungele ikhompuyutha olukwazi ukuzisakaza.
• Imodi ye-NAT: I-VM isebenzisa i-IP yomsingathi ukuze ifinyelele i-inthanethi ngokuhumusha kwekheli. Alutholi uxhumo olungenayo ngokuzenzakalelayo (ngaphandle kokuqondisa kabusha), okunciphisa indawo yokuhlasela evela ngaphandle.. Lokhu ngokuvamile kuyinketho ebhalansi yokuthwebula ithrafikhi ephumayo ngokuchayeka okuncane.
• Imodi yosokhaya kuphela: Idala inethiwekhi eyimfihlo phakathi komsingathi nesivakashi ngaphandle kokufinyelela kwangaphandle. Lena inketho ehlukanisiwe kakhulu; luwusizo ekuhlaziyeni okungadingi i-inthanethi noma uma ulingisa izinsiza zasendaweni ngamathuluzi afana ne-FakeNet-NG.

Ngaphandle kwemodi, imithetho eyengeziwe iyasebenza: Hlunga i-DNS, khawulela izimbobo, lawula izinqumo futhi uloge yonke ithrafikhi oyithandayo ngesiduphunga.Futhi uma uxhuma ama-VM amaningi, kwenze lokho engxenyeni ebonakalayo ehlukanisiwe ne-LAN yangempela.

Izifinyezo, ukutakula, nezinto zikagesi

Izifinyezo ziyindlela yakho yokuphila. Bathwebula isimo se-VM ngomzuzwana; uma kukhona okungahambi kahle, uyakubuyisela futhi yikho.Zisebenzise ekuqaleni kokuhlaziya nangaphambi koshintsho olubalulekile ngalunye. Zigwema ukufakwa kabusha futhi zenza ukuhlola okuphindayo kushesha kakhulu.

Enye inzuzo engokoqobo ukupakisha i-VM yakho “njengensiza” (OVA/OVF). Uma isilungiselelwe ngamathuluzi nezilungiselelo, ungakwazi ukuhlanganisa leyo phakheji futhi uphinde uyisebenzise kwenye ikhompuyutha noma wabelane ngayo nozakwenu.Kuyindlela esheshayo yokumisa amalabhorethri.

Uma icala lidinga ukuhlanzeka okuphezulu, cabangela izindawo ze-ephemeral: Dala, hlola, qoqa ama-artifact, futhi ucekele phansi; ngale ndlela unciphisa ukuphikelela kokumosha.Kuwusizo ikakhulukazi lapho usebenza nemindeni enezindlela zokusinda ezinolaka.

Amathuluzi nezinkundla: ama-hypervisors nama-analytics suites

Ukuze usebenzise ama-VM unezinketho ezimbalwa. I-VirtualBox imahhala futhi i-cross-platform; I-VMware Workstation/Fusion izinzile kakhulu futhi inamandla; I-Hyper‑V yakhelwe ngaphakathi Windows; ungakwazi futhi sebenzisa i-Windows Sandbox ukuhlolwa okusheshayo; futhi i-KVM inikeza ukusebenza okuseduze komdabu LinuxKhetha ngokusekelwe kusistimu yakho, ibhajethi, nesidingo sezici ezithuthukile (izithombe, amanethiwekhi ayinkimbinkimbi, njll.).

Imininingwane okufanele uyikhumbule: ku-VMware ecosystem, I-Workstation Pro (iWindows/Linux) ne-Fusion Pro (macOS) yizinhlelo zamanje; imigqa Yomdlali/I-Fusion Player inqanyuliwe ngokuthuthela ku-Pro.Uma ukhetha i-Linux, i-KVM ikhanya ngokuhlanganiswa kwayo ne-kernel nokuphepha kwayo, nakuba idinga ukushelela ngomugqa womyalo. imiyalo, i-libvirt, i-QEMU namabhuloho enethiwekhi.

Ukuhlaziya okuzenzakalelayo nokuhlela ama-VM, i-Cuckoo Sandbox ingeyakudala. Ikuvumela ukuthi uqalise amasampula, ithuluzi lesistimu (I-Agent/Monitor), uthole imikhondo namasignesha futhi unikeze imiphumela nge-API noma isixhumi esibonakalayo sewebhu.. Ilungele ukuhlaziywa okuguquguqukayo okuphindaphindwayo.

Uma ukhetha i-distro esivele iqondiswe ku-RE/malware, i-REMnux ikulethela isethi ekhethiwe yezinsiza. Kusukela kuma-forensics enkumbulo afana ne-Volatility ukubuyisela emuva amathuluzi obunjiniyela njenge-Radare2 noma amanethiwekhi alingisa nge-FakeNet-NG, ikubekela isisekelo esinamandla ku-Linux.

Cloud sandbox? Amasevisi asebenzisanayo afana ne-ANY.RUN akwenza kube lula ibhuthini isifinyezo se-VM "yelebhu" yokubuka ukuziphatha kwesikhathi sangempela. Ungahambisa igundane, uthayiphe, uqalise kabusha, uvule amafayela futhi ubone ukuthi isampula lisabela kanjani, konke kusuka kusiphequluli.. Iwusizo ekubukeni kokuqala okusheshayo ngaphandle kokulungiselela ingqalasizinda yendawo.

Ukusethwa Kwendawo: Yini Okufanele Ukuthinte Nokungamele Ukuthinti

Ngokungeziwe kuzilungiselelo zenethiwekhi nezifinyezo, kunezinketho zokulungisa kahle ezithuthukisa isignali ekuthwebuleni kwakho futhi zinciphise umsindo. Esihambelini esihloselwe ukuhlaziya okuguquguqukayo, kungase kube nengqondo ukukhubaza i-firewall nezibuyekezo ezizenzakalelayo. ukuze ithrafikhi oyibonayo ibe "izinto ezithakazelisayo kuphela." Yenza lokhu kuphela ngaphakathi kwelebhu ye-VM futhi ungalokothi emshinini wakho womzimba.

Ikhubaza ukuhlanganiswa kwe-hypervisor okungadingekile nesivakashi. Isivakashi esihlanzekile, awekho amathuluzi athuthukisiwe angakunikeza ukwenziwa kwezinto ezibonakalayo uma ufunda ukugwema, futhi kungekho ziteshi zokushintshisana nomsingathi. Khumbula ukuthi uhlelo olungayilungele ikhompuyutha luhlola ama-artifact e-VM futhi lushintshe ukuziphatha kwawo.

Ezingeni lokusebenza, gcina i-logbook. Bhala lokho okusebenzisayo, lapho uthatha isifinyezo, maphi ama-hashi nemizila oyiphathayo, ukuthi iyiphi ithrafikhi evelayo. Lokhu kuziphatha kusheshisa ukuphindaphinda izimo nokuqhathanisa imiphumela.

Vele, gcina i-hypervisor ne-base VM isesikhathini samanje. Amapeshi anciphisa ama-escape vectors futhi aqinisekisa ukuthi ama-API kanye abashayeli ezingokoqobo ziziphatha ngendlela oyilindeleAwufuni ukuba sengozini endaweni yangakini konakalise ukuhlaziya noma, okubi nakakhulu, ukuphepha kwakho.

Amacala okusetshenziswa okuvamile kanye nezinzuzo zangempela

Ubuhle bama-VM ukuthi ngomshini owodwa nje obonakalayo, uphindaphinda izinketho zakho: Ungasebenzisa isofthiwe kusuka kwenye isistimu, uhlole ukwakha kuma-OS ahlukene, futhi uhlukanise imisebenzi eyingozi.. Konke ngaphandle kokuthenga ihadiwe eyengeziwe.

Konjiniyela nabahlaziyi, ukuzihlukanisa kuyigolide. Uvula okunamathiselwe kwi-imeyili okusolisayo, usebenzisa izifaki ezingabazekayo, bheka ukuphikelela noma ukuxhumana kwe-C2 ngaphandle kokuthinta umsingathi wakho.Uma kukhona okungahambi kahle, ubuyela kusifinyezo nokunye.

Kukhona futhi ukukhushulwa okuncane kobumfihlo uma uhlukanisa imisebenzi kuma-VM. Ezinye izindlela zokunyathelisa iminwe zikhomba indawo okuyo; ukusebenzisa i-VM ehlukile yemisebenzi ethile kunciphisa ukuhlobana.. Qaphela: lokhu akukhona ukungaziwa komlingo, ukuhlanzeka kokusebenza.

Ukuphathwa kwezinsiza kuyavumelana nezimo: I-CPU, i-RAM nediski kwabelwa ngokomthwalo. Ungakwazi ukukhweza i-VM “elula” ukuze uthole isivivinyo esisheshayo noma enemisipha ukuze uthole okokulingisa noma izindawo zokwakha ezisindayo.I-hypervisor ikuvumela ukuthi ulungise indiza.

Ububi nokungaqondi okuvamile

Okubalulekile: I-VM ayisona isihlangu esingenakunqotshwa. Kunenhlawulo yokusebenza, ukuntengantenga kungenzeka uma usebenzisa ama-VM amaningi, futhi kukhona ama-vectors okuphunyuka angajwayelekile kodwa angempela.Kufanele uhlele unalelo qiniso engqondweni.

Futhi ayishintshi ezinye izendlalelo zokuphepha. Ukuzivikela okuphumelelayo kujulile: ukuhlukaniswa kwenethiwekhi, i-antivirus/EDR, izinqubomgomo ezinelungelo elincane, izipele eziqinisekisiwe kanye ne-inventory. I-VM iyisiqephu esisodwa, hhayi uhlelo lonke.

Enye inganekwane evamile ithi “hlala uvule i-inthanethi ukuze ubone ithrafikhi.” Lokhu akudingekile ngaso sonke isikhathi; Amandla amaningi angabonwa ngokulingisa izimpendulo ze-DNS/HTTP ngamathuluzi afana neFakeNet-NG.Ukuchayeka okuncane, ukulawula okwengeziwe.

Futhi ekugcineni, ungaphambanisi iziqukathi nama-VM. Iziqukathi zabelana nge-kernel nomsingathi kanye nezinqubo zokuhlukanisa; alula, kodwa awanikezeli ngokuhlukaniswa kwesistimu efanayo njenge-VM.Kuhlelo olungayilungele ikhompuyutha, ngaphandle kwasezimweni ezilawulwa kakhulu, i-VM egcwele ingcono.

Iyiphi i-hypervisor okufanele uyikhethe?

• I-VirtualBox: inkundla yamahhala, evuthiwe nesiphambano. Ivumela izifinyezo eziningi, amafolda abelwene, nemodi engenamthungo, nakuba abanye abasebenzisi bebona ukuqalisa okunensayo kanye nesixhumi esibonakalayo esiphelelwe isikhathi.. Umnyango omuhle wokungena.
• I-VMware Workstation Pro (Windows/Linux) ne-Fusion Pro (macOS): Ukusebenza okuqinile, inethiwekhi ebonakalayo ethuthukile, ukusekelwa okuhle kwezithombe ze-3D, kanye ne-ecosystem ebanzi. Idinga ilayisense yokusetshenziswa kwezentengiso; igatsha Lomdlali linqanyuliwe ngokushintshela ku-Pro.
• I-Hyper‑V: ihlanganiswe ku-Windows. Ilula kuzimo zokusingatha i-Windows ezineseshini ethuthukisiwe nekhono lokuhlolaKuhle uma usuvele usebenza ezindaweni ze-Microsoft.
• I-KVM ku-Linux: I-Kernel Integration kanye ne-Hardware Acceleration. Isebenza ngesivinini esiseduze kanye nezinzuzo ezivela kumodeli yezokuphepha ye-Linux; isekela izifinyezo ezibethelwe kanye nokudlula. TPMIjika lokufunda liyaqina uma ungajwayelene nenethiwekhi kanye ne-libvirt.

Amathuluzi okusekela okuhlaziya

Uma ubheke ukwenza ngokuzenzakalelayo futhi ubeke phakathi nendawo, i-Cuckoo Sandbox iyadingeka. I-Orchestrate VMs, faka i-ejenti ukuze igade imicimbi, yenza imibiko ngamasiginesha, futhi ivumele ukuhlanganiswa nge-API.. Ilungele amapayipi amathathu.

Engxenyeni yenkumbulo kanye ne-RE forensics, i-Volatility ne-Radare2 ziyisisekelo. Nge-Volatility ukhipha izinqubo, amamojula, nezinto zobuciko endaweni yokulahla; nge-Radare2 uhlola ama-binaries ngokulawula okukhulu.Ngakolunye uhlangothi, iFakeNet-NG, ilingisa izinsiza zenethiwekhi ukuze ibone ukuthi isampula “lidonsa kanzima” kanjani ngaphandle kokungena ku-inthanethi.

I-REMnux iphasela eziningi zalezi zinsiza ekusabalaliseni osekulungele ukusetshenziswa. Ukufakwa okulula kanye nesethi ekhethiwe ukuze ufike endaweni efanele, njenge-VM eyengeziwe elebhu yakho.

Uma ukhetha ifu ngesivinini, i-ANY.RUN inikeza isendlalelo esisebenzisanayo. Ikuvumela ukuthi ungenele ku-VM ngesikhathi sangempela (igundane, ikhibhodi, ukuqalisa kabusha) futhi ubone ukuziphatha empukaneni.Iwusizo kakhulu ekutholeni amasignali asheshayo ngaphandle kokulungiselela ingqalasizinda yendawo.

Kunini lapho i-VM inganele? Okunye nokuqiniswa

Kukhona uhlelo olungayilungele ikhompuyutha oluthola ukwenziwa kwezinto ezibonakalayo bese lulala noma luzicekele phansi. Kulezi zimo, kuyadingeka ukusebenzisa amasu okugwema i-artifact ye-VM noma, ngesikhathi esithile, uphendukele kuhadiwe ngokomzimba.. Yiba nohlelo B.

Uma wakha ibhentshi lokuhlola ngezinto zokusebenza zangempela, hlanganisa isistimu yezithombe ukuze ubuyisele izimo ezihlanzekile (isb., izixazululo zesitayela se-FOG nemihlahlandlela clone ama-hard drive anama-partitions amaningi). Ngale ndlela ugwema ukufakwa kabusha kusukela ekuqaleni ngemva kokuhlaziya ngakunye futhi wehlise isikhathi sokuphumula.. Gcina leyo zingxenyekazi zekhompuyutha ihlukanisiwe kunethiwekhi yakho yokukhiqiza.

Ihlanganisa izilawuli: ukuhlukaniswa okuqinile kwenethiwekhi, ukugunyazwa kwe-DNS, ukuthwebula kwethrafikhi, ukuloga okumaphakathi, futhi, uma kusebenza, i-EDR yokubuka i-telemetry ungaphandle. I-VM ihlinzeka ngethiyetha yokusebenza; izendlalelo ezisele zinikeza izindawo zokuphuma eziphuthumayo..

Izinhlobo ze-virtualization ezingaphezu kwe-VM ejwayelekile

Ukwenza izinto ezibonakalayo akukhawulelwe ku-OS yesivakashi. Kukhona i-hardware/server virtualization, software/application virtualization, isitoreji, ideskithophu kanye nenethiwekhiElabhu, ukuxuba okuningana kukunikeza ukuguquguquka nokuqina.

Ekwenziweni kokubona kwedeskithophu, isibonelo, ugcina izindawo zifinyeleleka ukude kunoma iyiphi idivayisi. I-virtualization yenethiwekhi ikuvumela ukuthi uhlukanise futhi ulungise umkhawulokudonsa, udale ama-subnet angokwezifiso nezinqubomgomo.. Yisebenzise ukuze uqhubeke uhlukanise ama-VM akho ekuhlaziyweni.

Isitoreji esibonakalayo, ngakolunye uhlangothi, kusiza ukuphindaphinda futhi sinciphise isikhathi sokuphumula uma kwenzeka isigameko. Uma ukuhlasela kufaka i-VM engozini, ubuyisela isendlalelo sesitoreji ngaphandle kokuthinta yonke indawo.Ukungqubuzana okuncane, ukululama ngokushesha.

Ubumfihlo bokusebenza nokulandeleka

Iphuzu okungaxoxwa kakhulu ngalo: umkhondo. Amadivayisi ephrofayili yezinsizakalo zewebhu ngokucushwa kwawo; ukuhlukanisa imisebenzi ibe ama-VM ngamaphrofayili enethiwekhi athile kunciphisa ukuhlobana.Akulona ungqimba lokungaziwa ngomqondo oqinile, kodwa lwengeza inhlanzeko.

Yiqiniso, uma uxuba yonke into ku-VM efanayo (umsebenzi, ukuphumula, izivivinyo), usula inzuzo. Chaza ukusetshenziswa nge-VM ngayinye, khawula ubunikazi, futhi uphoqelele ikhukhi engaguquki, isilandeleli, nezinqubomgomo zethrafikhi.I-Compartmentalization inengqondo uma uyihlonipha.

Futhi khumbula ukuthi amanethiwekhi ezinkampani anemithetho yobumfihlo kanye nezibhengezo zemvume ezinkundleni zezinkampani zangaphandle. Hlonipha izinqubomgomo futhi ukhawulele ububanzi bokuhlolwa kwakho ezindaweni ezigunyaziweUkuphepha kwezobuchwepheshe kuhambisana nokuphepha kwezomthetho nenhlangano.

Yebo, i-VM emiswe kahle ihlinzeka ngendawo ephephile ngokunengqondo yocwaningo lwe-malware, kodwa ayikwenzi kube umdlalo ongenabungozi. Ngezithombe ezifinyeziwe, inethiwekhi engayodwa, awekho amabhuloho okuba umsingathi, namathuluzi alungile, uzothola ukubonakala ngokulawula; uma isitha siphakamisa izinga, nawe kuzomele uliphakamise.Ukubheja kwakho okuhle kakhulu umqondo wokuzivikela ojulile kanye nesiyalo sokusebenza esingaguquki.

I-athikili ehlobene:

Isetshenziswa kanjani i-Windows Sandbox ukuhlola isofthiwe ngokuphepha nangokuvikelekile

Isaka

Umbhali oshisekayo ngomhlaba wamabhayithi nobuchwepheshe ngokujwayelekile. Ngiyathanda ukwabelana ngolwazi lwami ngokubhala, futhi yilokho engizokwenza kule bhulogi, ngikubonise zonke izinto ezithakazelisayo kakhulu ngamagajethi, isofthiwe, ihadiwe, izitayela zobuchwepheshe, nokuningi. Inhloso yami ukukusiza ukuthi uzulazule emhlabeni wedijithali ngendlela elula nejabulisayo.