Submitted by amit on Mon, 05/10/2015 - 16:37
Multiple browsers (Microsoft Edge, Microsoft Internet Explorer, Mozilla Firefox) Performance object leaks the Windows performance counter frequency (equivalent to physical CPU clock speed or virtual machine detection)
Advisory
Amit Klein
Submitted by amit on Mon, 05/10/2015 - 15:59
The following table summarizes the values of Windows Performance Counter Frequency in various Windows guest OS and VM implementations. In all cases, Windows (8.x/10) was the host OS - do note that very different results may be obtained on non-Windows host OS. Data was gathered in Q3 2015 with current versions at that time.
Submitted by amit on Fri, 29/05/2015 - 10:07
Here's a quick and simple web-based heuristic to detect a virtual machine (not 100% accurate).
Observation 1
1.a A typical virtual machine configuration assigns a guest VM a single (HT) core. Clearly this is not 100% accurate, but in the case of a large-scale virtualization (as is the case of sandboxing/research), it makes a lot of sense.
1.b A typical modern physical machine has multiple (HT) cores. I can't remember when I last saw a physical machine with a single core. Definitely not in the last 5 years.