Im using Windows 11 Pro. It has a feature called "Windows Sandbox", which is basically a virtual machine. If im getting a Virus inside of this sandbox, is it possible for that Virus to somehow "break free" from the virtual machine and also infect the host system? How safe is the Windows sandbox mode when it comes to dealing with viruses?
4
-
2There have been breakouts of virtual machines in the past. Also for Hyper-V, on which WIndows Sandbox is based. Side channel attack, Rowhammer, CPU bugs could also apply depending on the setup. But a virus needs to specifically designed for that.– secfrenCommented Jul 21, 2023 at 9:18
-
1When you say "But a virus needs to specifically designed for that", is this usually not the norm? I would imagine that a Virus developer might implement every known security exploits/problems to their viruses by default to maximize the spreading of it.– NicoleCommented Jul 22, 2023 at 15:09
-
It is not the norm. Why should someone add any kind of exploit and not just the ones required for the "job". Exploits cost money or effort to search them yourself. Depending on the virus some might also use VM detection specifically and stop running to avoid further analysis. Breaking out of a VM is a targeted attack unless VM usage becomes more common for the average user.– secfrenCommented Jul 22, 2023 at 17:32
-
That makes a lot of sense, thank you :)– NicoleCommented Jul 22, 2023 at 18:32
Add a comment
|
1 Answer
Possible? Yes, absolutely. Probable? No. Safe? Nearly 100% safe considering this feature is barely used or known by people. Most hackers are targeting actual VMs, e.g. VirtualBox/VMWare/Qemu, not something obscure such as a built-in Windows VM.
Side channel attacks are mostly a thing of the past unless you specifically disabled protections against them in your host OS. Besides they are not meant to escape your VM environment, but to gain knowledge of the host OS (e.g. secrets/passwords/etc).
For running unknown software I've been using SandBoxie+ which has almost a zero footprint but in theory it's a lot less secure than using a full fledged VM since it overrides system APIs.
answered Jul 22, 2023 at 9:09
-
This sounds promising. Im mainly concerned since im using important stuff like online banking on my computer. Would using the Microsoft Sandbox be a suffiecintly safe option to use when wanting to brwose untrustworthy websites/using untrustworthy programs? Or would you still recommend using an extra seperate computer for that?– NicoleCommented Jul 22, 2023 at 15:11
-
If you want to be super safe, yeah, having a separate computer on a separate network (meaning it's not directly connected to your LAN) is even better. AFAIK there are companies which offer remote desktops for such purposes. This must be even safer and requires no installation or maintenance. Commented Jul 22, 2023 at 17:07
-
1Still, cases of escaping a VM are relatively rare, so I wouldn't bother too much if I were you. You must be specifically targeted by three letter agencies or hackers for someone to be able to hack you via browsing in a VM. Chrome based browsers and Firefox all run in sand boxes nowadays by default, so even escaping them in your real OS is a very non-trivial task. Fire up a VM with any OS, create a non-administrator user in it and you're pretty much 100% safe. The hacker will have to hack four layers of protection: web browser, limited user account, virtual OS and lastly VM itself. Commented Jul 22, 2023 at 17:14
-
-
So, your calling a feature in a major commercial OS barely used, and claim on that basis that it will therefor be secure? Color me skeptical. Do you have corroborating evidence for / against these claims?– oɔɯǝɹCommented Aug 15, 2023 at 21:16