Hades

The decision that shaped everything else

The obvious move was to add this machine to the existing three-node cluster. More capacity, one management interface, live migration, shared storage. I decided against it, and it is the design choice on this page I am most confident about.

Clustering means cluster heartbeat traffic between the detonation host and every other node. It means shared storage paths. It means a management plane that can move a running virtual machine from this box onto one sitting on the production range. Every one of those is a channel between the machine where malware executes and the machines it must never reach. Convenience features are still connections.

So Hades runs standalone. It is managed separately, and the isolation is a property of the architecture rather than a policy that has to hold.

The detonation network

The isolated bridge is defined with no member interface at all. It is not a port that has been shut down or a VLAN with no route; there is no physical connection to the bridge, and the host does not hold an address on it either. IP forwarding is off, and there is no NAT rule or route for the subnet anywhere on the box.

Inside that network, a REMnux analysis machine runs INetSim, which impersonates the internet: DNS resolves, HTTP responds, mail is accepted. Samples that phone home get a convincing answer and never reach a real host. REMnux is configured with a static address and deliberately no default route, so it is isolated by its own configuration as well as by the bridge.

Egress verification · executed inside the detonation network
$ ping -c1 8.8.8.8          # the internet
   1 packets transmitted, 0 received   exit 2

$ ping -c1 192.168.50.1     # the management plane
   1 packets transmitted, 0 received   exit 2

$ ping -c1 10.40.40.1       # the cyber range next door
   1 packets transmitted, 0 received   exit 2

Getting samples in without opening a door

The usual conveniences for moving a file into a virtual machine — shared folders, clipboard sharing, drag and drop — are implemented by guest additions, and guest additions have a long history of escape vulnerabilities. Using them to carry malware in means the malware is sitting next to the exact component you would least like it to find a bug in.

Intake here is one-way instead: the sample is acquired on the host over the management interface, written into an ISO image, and that image is attached to the analysis machine as a virtual disc. The channel is read-only from the guest's side and carries no code path back out.

Building a machine you cannot log into

The REMnux appliance imported cleanly and then would not come up on the network. Two independent reasons, both invisible until I went looking: its network configuration targeted an interface name from the virtualization platform it was originally built for and did not match the name it got here, and SSH was disabled with no host keys generated at all.

No network, no console login, no way in. The fix was to stop treating it as a running machine and treat it as a disk: mount the stopped volume offline with guest filesystem tooling and repair it from outside — generate the missing host keys, enable the SSH service, and replace the interface-specific network configuration with a pattern that matches any interface, so this class of failure cannot recur on the next import.

Then a temporary bridge to the management network long enough to finish setup, and back to the isolated bridge permanently. The final configuration is the isolated one; the temporary path existed only during the build and was verified gone afterward by the egress test above.

What is still being built

I would rather show you an honest roadmap than imply this is finished.

• Phase 1 — complete. Host build, isolated bridge, REMnux with simulated internet, isolation verified.
• Phase 2 — in progress. A Windows analysis machine with the standard reverse-engineering toolset, installed unattended onto the isolated network. Its tooling installer needs internet, so it gets a temporary supervised bridge and then goes back behind the wall for good.
• Phase 3 — not started. An automated sandbox for volume triage. Nested virtualization is already enabled on the host for it.

There is also one honest loose end: the host has two network interfaces on paper but only one enumerates. It is not blocking anything — the isolated bridge deliberately has no port — so it is logged rather than chased.