this post was submitted on 24 Aug 2026
160 points (96.5% liked)
Cybersecurity
10496 readers
80 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Related:
Funny thing some malware checks if your hardware is virtualized. It is a bit tough to make a VM appear legit, so I tend to use a sacrificial laptop I have for this kind of work.
Your advise is good as it will tell you if the thing is real but the malware might not trigger.
My favourite story of this is that ransomware virus that was taking out places like the NHS, and some security researcher noticed it kept pinging some domain that was a random bunch of characters.
He registered the domain, and suddenly the ransomware shut down, freeing all the places the ransomware had infected.
It turns out when researching a virus the environments commonly treat all domains as valid so they can capture the traffic and see what the virus is doing. To prevent this, the ransomware was designed to shut down if this clearly fake domain came back as valid (and I guess this was the release switch if the ransom was paid). That was it would shut down if in this kind of a sandboxed environment.
The story is here, written by the researcher so it's a bit technical. There were lots of news stories about it at the time too.
Add to this, use Linux when dealing with sketchy things that you downloaded from sketchy places. If you configured it correctly, it won't be too difficult to undo any potential issues
What about Linux is easier than a similarly prepped windows device?
Unless it’s changed recently, windows you just need to press a button during load (like bios) to boot into safe mode. And from there you can reload a variety of “snapshots” to recover from most malware issues.
How is Linux easier than that, I don’t use Linux, but windows is incredibly simple already.
Mostly that the malware has a much higher chance of escaping containment on a Windows install, because it's designed to attack Windows.
Do you not know what loading a recovery snap shot does? It doesn’t matter if it escapes. Whatever was new is removed since it’s restoring your harddrive to a previous state. It’s like a backup harddrive, without being external.
There’s ways for the malware to disable recovery mode, but I would assume the same could happen to Linux as well.
Boot into windows safe mode and load a recovery image? Are you implying that it’s somehow difficult on windows just to bash them?
VMs have vulnerabilities, if you really want to be safe use a dedicated air-gapped pc, or don't run it at all.
You sitting on some hypervisor zero days worth fucking millions over here to infect some idiot trying to run GTA6?
You have any idea how many people don't update their computers?
I somewhat doubt the malware devs chucking their probably pirated copy of some cred stealer have implemented some zero day VM breakout exploit lol.
So do I, but there are enough people running out of date software that old vulnerabilities are still being actively exploited.