Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was directed here from the Unix & Linux site. I've gone through some of the related questions, but they seem to be more concerned about whether a guest OS can access the host OS in someway. Since it doesn't seem very likely, I'll tell you about my requirements.

When the user puts a USB memory stick in a USB port, the system should automatically download the data to a virtual machine, perform some analyzing, virus scanning, what not. After this, the payload should be made available to the host OS.

Beforehand the guest OS should be completely insulated from the host, so no access from the network, no mapped drives, nothing. But after the processing is done successfully, the host would need to find some way to get access to the payload. As well as destroying the VM.

Do you have ideas on how to implement this sort of thing, know of any existing solutions or any other insights?

Update: So this seems to be a feasible (and not a completely insane) solution, but there's one more issue. How to actually implement the communication between the Guest OS and the Host OS.

The most obvious solution is a network based approach, but due to the isolation requirements this can't be considered really. So what other approaches are there?

share|improve this question
    
Do you mean paravirtualization or classical OS emulation (WMWare)? Are you concern about USB driver vulns? –  curiousguy Sep 25 '13 at 16:40
    
In addition, I see no reason why you couldn't extend this concept for any type of download from the internet. –  Rubber Duck Sep 25 '13 at 17:23

2 Answers 2

I think this security solution could work if implemented properly.

Clearly the host OS could override the guest at any point, but in this case they are working together. The general case is that the auto-mount daemon needs to work with the guest OS to check the device. Each window manager will have their own way of auto-mounting devices. Its possible to disable this feature, and replace it with an auto-mount daemon that you can hook. In this hook you want to perform an action prior to mounting the device. (I think Halevt might be the best choice, but you should look at the other auto-mount daemons listed)

share|improve this answer

You need to ensure the following properties:

  • the virtual machine software and everything it relies on (host OS, hardware) is bug-free;
  • the virtual machine is configured for isolation: no drive sharing, no clipboard sharing, no network connection, …;
  • there is no process on the host that might cooperate with malicious software in the guest;
  • there is no hostile physical snooping on the host.

Assuming these conditions, the software on the guest is isolated. It may snoop on the host through side channel (mainly via timing measurements), but it won't be able to report back.

In order to maintain the isolation, provision a new VM where the content of the memory stick is made available to the guest. It doesn't have to be direct access to the memory stick, you can make a copy to internal storage (but you can also make the memory stick available to the guest if you like).

Note that what looks like a memory stick may not be a memory stick. For example there are devices that look like a USB memory stick but in fact contain a hub and not only a memory stick but a device that declares itself as a keyboard, or as a USB to Firewire bridge.

It isn't clear from your description whether the payload that you want to eventually make available to the guest is data stored on the memory stick, or data computed in the guest. If the latter, you can arrange for the host to read data from the guest without going through the guest software. Either arrange for the guest to write to a raw disk, or use guest filesystem support such as that provided by libguestfs. Note that the processing performed by the guest may have been affected by running in a virtual machine, for example sophisticated malware tends to detect that it's running in a VM and then doesn't reveal itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.