4

I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it is a virus could spread from the Linux distro onto my Windows. I've seen posts similar to this where answers usually mention a virus could still spread over a network, but I never saw Linux specifically mentioned. Does this still apply no matter the OS?

Edit: I am fully aware Linux still has holes and is still a target for malware. I only said one of the most secure because it's more secure than more widely-used operating systems like Windows.

| improve this question | |
  • Are you planning to download or receive via email items from your VM that you will later access on Windows or perhaps cut and paste objects between the two systems? If so many vectors to attack will be open. – zedman9991 Nov 25 '15 at 17:02
  • @zedman9991 I do not plan to do anything related to what I do on the VM on my main machine. No E-mails or anything of the sort will be shared amongst the VM and my main OS. – Kittencakes Nov 25 '15 at 17:10
  • Also Linux being the most secure operating system is a problematic statement for several reasons to include the fact that it refers to a kernel and GNU provides the rest. Recent vulnerabilities discovered such as shellshock, heartbleed, and OpenSSL suggest the phrase most secure is probably best left to even more limited use operating systems like BSD. – zedman9991 Nov 25 '15 at 17:11
  • @zedman9991 I never said it was the most secure. I simply said it was ONE of the most secure. I'm fully aware there's still possibilities for breaches in security, but it's much more secure then say...Windows. – Kittencakes Nov 25 '15 at 17:12
  • Probably a good plan for further sandboxing your browsing then... – zedman9991 Nov 25 '15 at 17:12
5

Virtualization is designed to protect the host operating system (in your case windows) from the guest operating system (Linux). It's unlikely that a virus or malware running on a guest is going to spread directly to the host through the virtualization layer. The malware would have to be specifically designed to target the virtualization layer, and somehow break out of the VM. I'd never say this was impossible, but it seems an unlikely target given the complexity of accomplishing this.

More possible is malware using the guest machine as a base of operations to launch attacks on anything inside your network.

| improve this answer | |
  • As @mike-of-many noted, host-guest directory sharing is definitely an attack vector even for common malware that looks for/spreads via specific files. For example, a Linux ransomware can encrypt all the files shared with the VM. – buherator Nov 25 '15 at 19:12
  • Indeed, it is highly recommended to turn off sharing if the VM will be used to execute malware (for this very reason). – Scott C Wilson Nov 25 '15 at 19:32
  • but just when there are no vulnerabilities in the virtualization software which allow it to break out of the virtual machine – Daniel Ruf Nov 26 '15 at 12:26
6

Depending on your setup between the host and the virtual guest there are a few ways that a worm or virus could propagate.

1) Simple networking. - If you have the networking adapter enabled on the virtual and the host can interact with it, then yes. A piece of malware that was multi-OS could propagate. Alternatively, if the malicious code was written in a cross-platform engine like Java, and you run Java on both the guest and host. This could be from setting the guest networking to host only, or host networking. Technically possible with any enabled networking, but more likely with those two. Nat and Bridged form the connection to the host's NIC differently.

2) Sharing enabled. - Having the host files or the clipboard even be writable to the guest can allow for an escape or evasion tactics. VMWare shared folders had at least one CVE published for escaping the guest via the shared folders function.. 2008-0923 when I searched it, but there might be more.

3) Driver based - Venom by crowdstrike showed how to do a Virtual escape based on the floppy driver being enabled by the guest. There may be similar vulnerabilities for other drivers.

| improve this answer | |
  • Could you elaborate on Having the host files or the clipboard even be writable to the guest as it isn't clear as to how the virus could escape? – Motivated Nov 26 '15 at 7:59
1

Alter hardware host from wm

For my knowledge, there is now no way to alter a hardware node from a vw (container).

But I could be wrong, depending of wich virtualisation technology is used...

Spy hardware host from vm

Yes, it theorically be:

By analysing multi-cores CPU loads (or idle time) and/or temperature variations, a vm could spy what's going in parallels tasks (vm or host)...

But if your Linux is correctly maintened, with strong password, security policy and up to date...

For my opinion I will prefer

to run Linux on Hardware node, (coreos or debian), and create at least two vm:

  • Windows, by using KVM
  • Linux, by using LXC

Easier to maintain, scale and backup, but this is only my opinion.

But this won't change theorical parallelisation risks on multi-cores CPUs.

| improve this answer | |
-2

Is it possible? Yes. One of the first Worms (a self-replicating piece of malware) was designed to work under the Unix system. And while Windows malware is certainly more prevalent, there are bad guys targeting Linux too. Remember that as soon as a piece of malware is on your system, it can download and run arbitrary code. So a Linux virus could certainly download a Windows virus and run it on another machine (whether it be the host VM or a remote machine).

How could it be done? Such an attack (from VM to host machine) would rely on a vulnerability in the virtualization layer. Such vulnerabilities have been seen; this CVE documents such case.

| improve this answer | |
  • He is wanting to know how a virus could spread from the VM to this host. Not if a virus can be on Linux. – Bacon Brad Nov 25 '15 at 17:13
  • @BradMetcalf Yes, this is what I mean. – Kittencakes Nov 25 '15 at 17:15
  • @scott-wilson How can a Linux virus download a Windows virus and execute it on the host machine? Also, a host machine is not a remote machine. – Bacon Brad Nov 25 '15 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.