> Nope, you have to distinguish between a sandbox (code is run) to an AV
> scanner scanning code in a VM, when the av scanner scans the code, the
> code is not executed and cannot decide whether it is inside a VM =)

Wrong. This would be true only if the AV didn't have the parsing bug in
the first place. If the AV is buggy and allows some form of arbitrary code
execution, the attacker -does- have the code executed inside the VM; and
nothing stands in his way of detecting whether it's a real machine or not.
If, on the other hand, the AV was not vulnerable... then, what would be
the gain of running it inside a VM? :-)

Peter

--
[Name] Peter Kosinar [Quote] 2B | ~2B = exp(i*PI) [ICQ] 134813278

[ reply ]