This is a good idea and a good practice in my opinion. Some malicious code detects when it’s being sandboxed and hides itself until it’s running somewhere it can do damage though.

[–] 7Sea_Sailor@lemmy.dbzer0.com 5 points 10 months ago (2 children)

Once malware is VM aware it can also get outside a VM. Furthermore, malware can be written to seat itself comfortably in your PC and lay low for hours, days, weeks before becoming active. Installing in a VM and waiting for shit to hit the fan is not always reliable.

[–] bamboo@lemm.ee 10 points 10 months ago

Getting out of a VM reliably is not usually trivial, and VM escapes are usually designed to target specific configurations rather than an arbitrary deployment. A VM with a minimum amount of shared resources is usually a reasonable security boundary unless you think the malware you’re analyzing has hypervisor-specific 0 days.

[–] sir_reginald@lemmy.world 3 points 10 months ago

the malware has to be very advanced and specifically target your hypervisor version to escape a VM.

in the context of cracked software, it is highly improbable that you'll find malware with this capabilities.

[–] DarkDarkHouse@lemmy.sdf.org 1 points 10 months ago

And start with no network for the VM