Native VM detection

ID:1936443
 
Sep 15 2015, 11:21 am
Applies to:Dream Seeker
Status: Open
Issue hasn't been assigned a status value.
Descriptive Problem Summary:

Ban evasion is simple, all someone has to do is change their IP, install a virtual machine, and create a new account.

But it shouldn't be that easy to fly under the rader, that's why i'm filing this feature request, VM detection could easily help finding bad players (e.g. account made seconds ago, user is using VM? -> Place on watchlist)

This could be made a lot harder if DS where to implement native VM detection which sets a variable on the client e.g. virtual_machine which has three states.

0. Client is not using a VM
1. Client is using a VM
2. Unable to determine if the client is using a VM

Detecting a virtual machine

VirtualBox
http://spth.virii.lu/eof2/articles/WarGame/vboxdetect.html

VMWare
http://kb.vmware.com/selfservice/microsites/ search.do?language=en_US&cmd=displayKC&externalId=1009458
Sep 15 2015, 7:03 pm
Using a VM is a legitimate way of using BYOND, though.
Sep 15 2015, 8:00 pm
It is, but I know being able to detect it would be a valuable tool for the SS13 community.
Sep 15 2015, 10:33 pm
In response to Lummox JR
Lummox JR wrote:
It is, but I know being able to detect it would be a valuable tool for the SS13 community.

Totally, we all understand that using a VM is normal for some users that run *nix or OSX type systems, but it's extremely handy and could actually help find ban evaders.

e.g.

if account is made today + user is using VM -> add to watchlist to alert admins of bad things the user may do.

This might be a good start tough, @lummox http://handlers.sans.org/tliston/ ThwartingVMDetection_Liston_Skoudis.pdf