Virtualization - Week 1

Introduction

Creative Commons Attribution 4.0 International License ©2017 Focus on Creating a Safe Lab Environment in Operating Systems through Virtualization to facilitate better learning experiences in system security and malware analysis.

Prerequisites

Familiarity with:

  • Installed Windows operating system: understanding basic navigation and control.

  • Installed an operating system other than Windows: knowledge of at least one alternative OS such as Linux.

  • Installed a Wi-Fi system: ability to work within network configurations.

  • Used Cloud resources: experience with cloud services (e.g., AWS, Google Cloud).

  • Set up your own network: foundational networking skills including IP configuration and router management.

Learning Outcomes

Upon completion, students will be able to:

  • Define key virtualization terms: airgapped, bridged, host-only, and NAT, understanding their purposes and use cases in a lab environment.

  • Utilize virtualization technologies to create and manage a safe testing environment that isolates potential malware infections.

  • Demonstrate various networking setups to ensure virtual machine (VM) isolation and control communication between VMs and the host.

Need for a Lab Environment

Importance of lab environments for learning new skills in the field of IT and cybersecurity:

  • Isolation: Provides an isolated environment to prevent infection or misconfiguration in production systems, protecting critical data and functionalities.

  • Experimentation: Facilitates hands-on learning without the risks associated with live production environments.

  • Common lab environments include:

    • Physical machines with airgapped networks for manual experimentation.

    • Virtual machines allowing multiple OS installations on a single physical host.

  • Each approach offers distinct advantages and disadvantages, influencing the choice depending on the specific learning objectives.

Physical Machines

Physical machines serve as a test environment leveraging actual hardware:


  • Advantages:

    • Limits Anti-Analysis Behavior: Many malware programs behave differently when they detect a virtual environment, allowing for more authentic malware analysis.

    • Airgapped Networks: Offer a truly isolated network, providing physical separation from potential threats on the Internet.

    • Easier Control Over Malware: By managing hardware resources, it can be easier to prevent malware from using anti-analysis techniques.


  • Disadvantages:

    • Higher Cost: Requires investment in hardware and networking infrastructure.

    • Time-Consuming Malware Removal: Cleanup post-infection can take longer than virtual environments, often requiring physical access to the machine.

The Use of Virtualization

Virtual Machines (VMs) allow a host operating system to run multiple guest operating systems simultaneously:


  • Functionality:

    • Acts like a computer within another, facilitating efficient resource utilization while enabling safe testing.

    • Enables snapshots, allowing users to revert to previous states for analysis.


  • Risks:

    • Vulnerabilities exist, particularly guest-to-host vulnerabilities, which can exploit the architecture of virtual systems.

    • Special care must be taken to prevent malware escape from the guest OS to the host OS.

Virtual Machines

VMs come with various benefits and limitations:


  • Advantages:

    • Enable functionality for multiple OSes to coexist on a single host, making learning diverse environments feasible.

    • Snapshots: Allows for rapid state restoration for testing redundancy.

    • Flexible networking configurations can support tailored lab setups to suit different security scenarios.


  • Disadvantages:

    • Misconfigurations within the VM networking could lead to unintentional malware infections.

    • Heavy resource usage can compromise hardware performance, affecting multiple VMs' functionality.

    • Developers must stay updated on known vulnerabilities that could impact the VMs.

Anatomy of a Virtual Machine

Components that comprise a Virtual Machine:

  • Guest OS (Virtual Machine): the operating system running within the VM.

  • Host OS (Physical Machine): the primary operating system on the physical hardware.

  • Virtualization Software: Applications like VirtualBox or VMWare that facilitate virtualization.

  • Monitoring and Analysis Tools: Software for analyzing traffic, performance, and security-related data to enhance learning and research.

Virtualization Software

  • VirtualBox:

    • Maintained by Oracle.

    • Free to use under GPL version 2, making it accessible for students and learners.

    • Full support for VM snapshots, allowing users to capture the state of a VM.

  • VMWare: provides a suite of products with differing functionalities.

    • Workstation Player: free for non-commercial use but lacks snapshot feature.

    • Workstation Pro: full support for running multiple OSes but requires a paid license.

    • Fusion: designed specifically for macOS, also requiring licensing.

Setting Up VirtualBox

  • Current version: 7.14; important to ensure compatibility with system hardware and operating systems:

    • Use Windows Task Manager to verify virtualization capabilities and status.

    • For macOS, checks can be made in System Report or via the Apple Hardware Test app to confirm virtualization support.

VMWare Workstation Player

Previously free; it now presents purchasing options, particularly for Fusion or Pro versions targeting enhanced functionality.

Creating a Virtual Machine

Steps to create an effective VM:

  • Initiate a new virtual machine creation.

  • Utilize an installation disk (ISO or DVD) to source the operating system.

  • Configure virtual hardware settings including processors, memory allocation, and storage options.

  • Execute the OS installation and finalize the VM setup with adequate configurations.

  • Install any additional required software and establish user accounts for operational access.

Networking a VM

It's crucial to understand the essential networking configurations available for virtual machines:

  • Not Connected: isolates the VM from any network access, useful for absolute isolation.

  • NAT: Network Address Translation where a virtual DHCP server assigns IPs within a private network, allowing the VM to access external networks via the host OS.

  • Bridged: establishes a direct connection of the VM to the local network using the host adapter for real-world interactions.

  • Host-only: creates a private LAN connection between guest and host OS. While limiting malware’s reach, it still allows some internal communications.

Snapshots

A method to preserve the state of a virtual machine:

  • It is particularly beneficial to take a snapshot after installing and configuring the VM, as this can save time during testing or analysis cycles.

  • Allows for seamless cleanup and iterative testing without the need for complete reinstallation of the VM components.

Summary

Students will acquire skills enabling them to:

  • Define key terms including airgapped, bridged, host-only, and NAT for operational understanding.

  • Effectively utilize virtualization strategies to create and manage safe test environments.

  • Ensure comprehensive virtual machine isolation through thoughtful networking configurations and snapshot management.