Tag Info

New answers tagged

0

I think that VM escapes are always due to vulnerabilities in the VM system that you are using. So the way it works is: Find a vulnerability in a VM system. Figure out how to exploit it. Do that to a VM that you want to escape from. As a totally made up example, consider a virtual host with a buffer overflow that happens when writing large files. An ...


2

You can not securely use encrypted virtual machines without full disk encryption on the host. While the virtual machine is running, the host stores memory chunks, log data, configurations, and loads of other files on disk, leaving permanent forensic trail of a live decrypted virtual machine. File and project names will almost certainly be recoverable. If ...


2

You have a few options, and it'd probably be best to do at least the first two: Encrypt your host operating system's drive using BitLocker or doxbox. When installing your guest operating system, do the same thing inside the guest. VirtualBox and other VM hosts provide the option to encrypt the virtual drive. All drive contents are encrypted before written ...


1

I am sorry if I am missing something simple in your question. Why not just store the image on an encrypted drive? You could store the image or the entire VirtualBox folder on the encrypted disk so that way you need the key to be able to access it.


11

Amazon advisory links to the original XEN advisory on which one can read: Systems running only x86 PV guests are not vulnerable. So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM). ...


1

Docker attempts some tricks to contain processes, but the creators themselves acknowledge they aren't effective containers of applications out of the box. Since you are concerned about security, but aren't interested in a heavyweight VM environment, I would recommend running SELinux and Docker together. SELinux can automatically apply an MCS label to each ...


0

This by no means is a solid answer (I'd rather leave this as a comment than an answer, but I do not have the proper reputation). Depending on the network settings of your VirtualBox, if someone somehow got control of your VirtualBox, they could possibly get into your router or other devices on your network depending on settings and situation. Not to ...


1

If you can not trust your virtualisation software, you're in deep trouble. The virtualisation software can do *anything it wants) to the virtualised code (due to direct memory manipulation) but this is at the level of "Hey, can someone steal my creditcard data even if I encrypted it from memory when the memory is full of measurement probes?" (a.k.a. you ...


4

I just put some opinions from this link: If they wanted to include backdoors in VirtualBox, they would've closed the source a long time ago. Why would they spend time implementing a backdoor in open-source software that, if ever detected, would pretty much lead to everyone abandoning the software en masse? Leaving it open allows potentially thousands of ...


1

Running in a virtual machine will generally provide a good amount of isolation. You can also use a sandbox tool which is included with many anti-malware packages or an independent one such as Sandboxie. Other alternatives include using a live cd that you boot fresh each time you want to have a known system state. However, the reality is that malware on your ...


1

Yes, a VM with a fresh, fully-updated OS from a known clean source can protect you from some types of malware on the host. If you have no other way to work from a known clean system, then this can be a 2nd best alternative, but some types of malware can still cause problems for you. The other thing is that I'm not sure how "quick" this will be for you. ...


2

(Disclaimer: I am not an authority on OpenVZ. This answer is more opinionated than my answers usually are, so feel free to criticise!) OpenVZ might be "more" secure in that it does not integrate with the entire kernel, so that its attack surface is a bit lower. Though, essentially OpenVZ is what served as inspiration for namespaces and hence ultimately, LXC ...



Top 50 recent answers are included