Honeypots: Re: Stealth VM

["Thorsten Holz" <thorsten.holz () gmail com>]

On Fri, Nov 7, 2008 at 3:53 PM, Robert Sandilands
<rsandilands () authentium com> wrote:
> The majority of Wildlist samples will not work in VMWare.
Robert, do you have some concrete numbers for that claim? In our test,
we observed that less than 10% of the samples did not run within
VMware (tested about half a year ago). This test was based on the
samples we receive at cwsandbox.org, so it may be a bit biased. But if
I take a look at the Wildlist (where I doubt that it provides a
realistic overview of current threats), I see lots of online gaming
stealers, IRC bots, and similar malware that commonly does not include
checks for VMware. Thus some more evidence for your claim would be
nice.

Cheers,
  Thorsten