1

I am working with several maintainers of Homebrew currently to verify that several programs in the cask library now ship from the developer with trojans. To verify the claims I created a Virtual machine in Oracles Virtualbox running Elementary OS (linux based on debian).

From there I downloaded the suspected files and uploaded them to virus total (https://www.virustotal.com/gui/file/71e362921a19923d8cd19052641718b91b8c967aa1b0f277e7732c2901a6234b/detection). I downloaded both the Windows exe file and the Mac dmg file. The Windows file came up with malware but I was unable to check the Mac version do to a large file size. Following this I deleted the Virtual Machine.

Is there a chance that this DMG, which is possibly infected, could attack my computer which is running MacOS? Clearly the windows exe wouldn't be an issue but what about the DMG?

Improve this question
2
  • 1
    I don't see any mechanism for host attack based upon your description.
    – user10216038
    Commented Nov 20, 2020 at 1:01
  • Also, don't just think a malware, especially if you have no knowledge is not going to try and looking for routes... so look into sandboxing solutions out there. The bird solution is what I have used in the past.
    – SysRisk
    Commented Nov 20, 2020 at 3:00

1 Answer 1

Reset to default
1

Virtualbox provides sandboxing by creating entirely new virtual system inside your host system. Its isolates the virtual system from the host machine, any thing you do inside the VM won't directly affect your host system, unless there is some host-only communication which probably gives some worm to try to attack your host system. But as long as you did not install the infected package in the first place, it will be okay.

Improve this answer
5
  • Makes sense. Perhaps a simple question, is it possible for a malicious download/upload in virtualbox to interfere with a legit download on my main system? At the same time I was downloading a program and want to make sure if wasn't compromised.
    – Harrison G
    Commented Nov 20, 2020 at 1:13
  • 1
    Nope, doing such thing requires an attacker-controlled node between your system and the server, also called Man-in-the-Middle attack. Also I guess you were downloading from HTTPS-enabled website, so its unlikely such thing can happen.
    – maximillian1
    Commented Nov 20, 2020 at 1:17
  • 1
    Also Virtualbox VM is a system INSIDE your host machine, not between your machine and the server.
    – maximillian1
    Commented Nov 20, 2020 at 1:18
  • Could I also add? Elementary OS makes then when you click on a file it automatically tries to run this. I made this mistake and got an immediate error says the OS does not support exe. Have there been known viruses that cause exploit linux through exe without installing? Or for the DMG I compressed it to fit on virus total.
    – Harrison G
    Commented Nov 20, 2020 at 8:06
  • 1
    1. Windows and Linux runs on entirely different architecture, so afaik such kind of attack is impossible. 2. DMG is just a disk image/archive which contains the installer inside, as long as you didn't run the installer I guess it will be fine
    – maximillian1
    Commented Nov 20, 2020 at 12:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .