5

Background:

I have a Virtual Machine which is running all it's traffic through a VPN (from within the Virtual Machine) so to obfuscate all web traffic. This Virtual Machine is running from within an account with limited privileges on a Windows PC.

This Virtual Machine would be used to access the internet and whilst the Virtual machine is running, all it's data will be held in volatile form.

To be clear:

I'm not asking how to secure this Virtual Machine.

What I would like to know is:

What information or data concerning the activity of the Virtual Machine could be logged either by the Windows Machine (which the VM is running on), or by the network surrounding this Windows Machine?

Thanks

Improve this question
4
  • None, as far as i can see, but I am curious too. good question!
    – JOW
    Mar 7, 2016 at 10:20
  • 2
    How is the traffic routed? Is the Virtual Machine connected to a VPN on the inside, or from the outside? To clarify, are you connecting to a VPN on the main OS, and having the VPN use that connection information? Or are you connecting to a VPN from the Virtual Machine? Both?
    – Mark Buffalo
    Mar 7, 2016 at 14:14
  • VPN is installed within the Virtual Machine
    – Apparent
    Mar 7, 2016 at 14:32
  • If the VPN is terminated in the virtual machine then nothing prevents that VM from bypassing the VPN and talking to the Internet directly. The right way to do it would be to terminate the VPN on the host and have its firewall redirect all its traffic through the VPN. That way the VM itself has no way of reaching the Internet directly and doesn't even know it's behind a VPN.
    – André Borie
    Jun 6, 2016 at 18:47

2 Answers 2

Reset to default
1

What information or data concerning the activity of the Virtual Machine could be logged either by the Windows Machine (which the VM is running on)

Everything. The host has complete, unrestricted access to the guest. It may be possible in the near future to make VMs a bit more secure from their hosts by utilizing SGX (Software Guard eXtensions) on Intel Skylake processors. These use the CPU's Management Engine to encrypt data in memory so even the host's ring 0, the supervisor mode, cannot view it.

If you are asking what is unintentionally left over on the host, as opposed to maliciously snatched by the host, then it's mostly limited to swap (called virtual memory on windows) which is written to the disk when memory pressure is high, coredumps, which are performed when certain applications crash, and screenshots, which many virtual machine managers automatically take.

or by the network surrounding this Windows Machine?

Other than side channel metadata such as packet sizes and timings, an external network may be able to tell the guest's operating system version and uptime. See http://lcamtuf.coredump.cx/p0f3/ for an example of this, called TCP fingerprinting.

Note that a VPN does not obfuscate web traffic, it encrypts the contents of web traffic. This is fine if you are trying to hide the literal contents of your communications from your ISP, but it is not particularly effective at keeping you anonymous.

Improve this answer
0

Please see this link: https://tails.boum.org/doc/advanced_topics/virtualization/index.en.html#security

basically it's stuff like

  • If the host operating system is compromised with a software keylogger or other malware, then it can break the security features of Tails

  • Host operating systems usually use swapping (or paging) which copies part of the RAM to the hard disk.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.