Blacklisting non-vm computer as vm

[pinkestflamingo]

Enabling the following options on your Windows computer will create the disk 'PROD_VIRTUAL_DISK' which is blacklisted by SEB:

• Windows Subsystem for Linux
• Windows Sandbox

This caused me to get flagged each and every exam for 8+ months and I had to attach a debugger to SEB to understand where it is flagging me.
Filtering for "PROD_VIRTUAL_DISK" is the most stupid thing I've seen to detect virtual environments.

It is embarrassing that having a virtual disk is a detection vector. Step up your game. EMBARRASSING!

[danschlet]

@pinkestflamingo Please mind your language. We don't tolerate verbal abuse (this is not Twitter -> X).

[dbuechel]

@pinkestflamingo Try to retain some basic manners, otherwise it is unlikely that you'll make your wishes heard.

@Notselwyn Could you please have a look at the issue and specifically investigate whether there is a way to distinguish between a physical system having a virtual disk installed and a virtual system running on a virtual disk.

[Notselwyn]

@dbuechel Is there any chance this is a logic bug? "PROD_VIRTUAL_DISK" is stored in DeviceWhitelist, leading me to believe it should not be flagged. Unless of course it is not "PROD_VIRTUAL_DISK" triggering VM-detection.

DeviceBlacklist.Any(d => device.ToLower().Contains(d.ToLower()))
	&& DeviceWhitelist.All(d => !device.ToLower().Contains(d.ToLower()))

https://github.com/SafeExamBrowser/seb-win-refactoring/blame/b3228aedef5c2896a103f990f8bd56170fe2c493/SafeExamBrowser.SystemComponents/VirtualMachineDetector.cs#L74

[dbuechel]

You are very correct indeed! I doubt that we have a logic error there, I vaguely remember introducing the whitelist which then has been verified by our internal testing.

@Notselwyn Do you happen to have the capacity and time to debug the issue and verify that it can't be PROD_VIRTUAL_DISK triggering the detection?

[Notselwyn]

I did some fiddling (https://dotnetfiddle.net/eG3JXN) and it seems it should indeed not trigger. Unfortunately I do not have access to devices with Hyper-V or WSL support laying around, so I cannot test for any cases where the literal string is not PROD_VIRTUAL_DISK, however the reporter is claiming that it is.

[dbuechel]

Thanks, this already should prove that the VM detection was not actually triggered because there is a virtual disk installed on a physical machine.