Virtual Machines
- we may be using a malware analysis environment based on Windows 7 this semester
- in fact, we will be distibuting a Windows 7 OVA file with many of the necessary tools already installed
- this file is big! almost 20 gigs!
- Feel free to install Sysinternals, a package of tools that Microsoft offers. Sysinternals is a suite of tools that Microsoft actively maintains. We will include a couple of these in the Flare machine
- You can add Sysinternals to your path on Windows, by editing an environment variable in the system properties area.
- you'll need to have a UMBC IP address in order to download this and many of the files. we provide. Do it from campus, or over the VPN.
- you DO use a VPN all the time, right?
- use right-click and "save link as" for this and similar downloads
- if you happen to need Windows XP to analyze older malware
- This XP system has none of the tools we use (windowsXP.ova)
- This OVA file has a similar XP system, but with some useful tools installed...
- Why XP? Some malware and some tools run on XP but not on newer systems. The exercises from the PMA textbook are written for XP.
- Feel free to see if YouTube has a demonstration of installing Virtual Box.
- We do recommend making VM disk drives big, at least 50 gigs, with dynamic
allocation, even if there is a modest performance hit as a result (why would this happen?)
- what if your computer is too slow to run VMs? it may
need more memory.
- Here are the slides that will introduce more technical content!
- We won't cover it in class, but you may find it helpful to have a Linux VM, too
- You probably know how to get a copy of Linux: many linux distros are available
at distrowatch
- There's always something to learn when it comes to Linux
- By the way, the idea that malware is not a problem for Mac or Linux users has been debunked for a long time.
- There are some good places to get Windows-related documentation.
- Students can open a ticket at http://my.cs.umbc.edu/ to request a Microsoft Imagine Premium account through UMBC. Access lasts for one
year. Students are allowed to keep any software they
download. You do NOT need to do this to do well in the class.
- A link to Windows documentation from Microsoft is included in the Flare VM