VMware Virus-Testing Environment?

[Darn4man]

Hello fellow VMware users,

I have decided to set up a virtual machine virus-testing environment.

I wanted to ask if anyone had

knowledge on how to prevent host - virtual machine interaction. I will

most likely use a bridged network connection to my own computer, and I

want to secure any possibility that a virus may infiltrate my host

computer ( like a worm or something) or the network on which i'm running (there are other computers running in the same network in my household), if there is any chance

this could happen. I am just wanting to know if there is anything that

i can do to secure the safety of my computer(s) before i go ahead and set

up this crazy idea?

Thanks in advance.

Other Info: Don't know if this matters: Running an XP Home Edition SP3 -- Pentium 4 Processor -- 3.00 GHz -- 1 GB of RAM

Running XP Home Edition on VMware Workstation version 6.5.3

[VMmatty]

If you use bridged networking then you run the risk of the virus moving off of the virtual machine and into your network. If I were you I would disconnect the NIC altogether or at least put it on a non-routable IP network so it can't communicate with the outside world. Then you can use the Shared Folders feature in VMware Workstation to copy files from the host machine to the virtual machine. Shared Folders uses VMware Tools and a virus won't be able to exploit that connection.

Does that make sense?

[Darn4man]

I understand that if I run bridged, I will suffer the risk.

This is why I am trying to find a connection that is somehow untraceable to the

host computer, but still getting an internet connection. Would a virtual

network do anything? Is there any alternative? If there really isn’t an

alternative, I can work with that, but I just need some advice of how I’m going

to do networking before doing this.

Thanks for the reply by the way.

[VMmatty]

NAT is probably your best option if you need to get Internet access. That allows you to get on the Internet without needing an IP address on your home network.

Is there a reason why you need Internet access to test the viruses? If you explain what you're trying to do we might be able to come up with a safer alternative.

[Darn4man]

I will need access to the internet to get some resources and other tools necessary to set this up. Possibly a deactivated antivirus i might want to update, to remove the viruses. But here i also face the question, "Where am i going to get my test subjects?" (I dont really have a particular source at the moment, i will have to find one; I am only in the process of setting this up.) But is there any way to isolate this connection? or is this unrealistic?

EDIT: This is a wacky and crazy idea that i really dont know what direction i am heading in. I am just fascinated and i just really have an interest in this kind of thing, i really do not know why. I have always kept my PC really clean, with a very good antivirus (Kaspersky). But I really find it disappointing that I really have no way of seeing these kinds of things with my own eyes, so i thought it would be a cool idea to make a drone computer to just see what viruses can do these days. But I mean who knows where it could go from here.

Thanks.

[VMmatty · Accepted solution]

I would try using NAT, which essentially lets you share the IP address of the host workstation and will let you communicate with other systems and the Internet. I have no advice for you on "test subjects" if you're referring to where you're going to get viruses for testing. The only one I know of us is the well known test virus Eicar. You can find it here: http://www.eicar.org/anti_virus_test_file.htm.

I still think the safest way to do this is to disable the network card altogether. You can still transfer files to the virtual machine via the Shared Folders option in the VMware Tools and keep your host system safe. You could transfer in new virus definitions, infected files, and keep your host system safe while still having your testbed completely isolated.

If you end up using this to create a new virus and causing grief for IT administrators across the world, do me a favor and forget I offered any advice.

[Darn4man]

Nah Man I aint talking about those funny little harmless ones, i really want to see how these viruses have become so powerful. During the conficker scare, i was just dying to see what this thing could do, i was more intrigued by it than scared by it, in a wierd kind of way...so i mean as i edited in my above post, i really want to see what these things are made of, even thought it might be for my own personal amusement. But i mean im training to fix computers (Computer repair) and im interested by this stuff, so having a computer to screw with is a cool idea in my mind. So yeah thanks for the suggestion, ill tell you how that works out.

EDIT: Oh no im not looking to create, just observe. Please do not get that idea. I mean i'm hoping to get A+ certification before next summer, and fixing computers can range in all aspects, so learning about this stuff is all for educational purposes.

Thanks a lot.

[VMmatty]

I'm only kidding.. One of the nice benefits of using virtual machines is the ease with which you can throw together test environments and isolated servers for all sorts of reasons. If using this helps you get your certification then I'd be happy to hear that.

Give it a try and report back if you have any other problems.. Good luck.