3

I am looking into VMs to use, and from wiki https://en.wikipedia.org/wiki/Virtual_machine

I notice there are 3 main types of VMs.

FULL VIRTUALIZATION

In full virtualization, the virtual machine simulates enough hardware to allow an unmodified "guest" OS (one designed for the same instruction set) to be run in isolation. This approach was pioneered in 1966 with the IBM CP-40 and CP-67, predecessors of the VM family. Examples outside the mainframe field include Parallels Workstation, Parallels Desktop for Mac, VirtualBox, Virtual Iron, Oracle VM, Virtual PC, Virtual Server, Hyper-V, VMware Workstation, VMware Server (discontinued, formerly called GSX Server), VMware ESXi, QEMU, Adeos, Mac-on-Linux, Win4BSD, Win4Lin Pro, and Egenera vBlade technology.

HARDWARE VIRTUALIZATION

Hardware-assisted virtualization[edit] Main article: Hardware-assisted virtualization In hardware-assisted virtualization, the hardware provides architectural support that facilitates building a virtual machine monitor and allows guest OSes to be run in isolation.[18] Hardware-assisted virtualization was first introduced on the IBM System/370 in 1972, for use with VM/370, the first virtual machine operating system. In 2005 and 2006, Intel and AMD provided additional hardware to support virtualization. Sun Microsystems (now Oracle Corporation) added similar features in their UltraSPARC T-Series processors in 2005. Examples of virtualization platforms adapted to such hardware include KVM, VMware Workstation, VMware Fusion, Hyper-V, Windows Virtual PC, Xen, Parallels Desktop for Mac, Oracle VM Server for SPARC, VirtualBox and Parallels Workstation. In 2006, first-generation 32- and 64-bit x86 hardware support was found to rarely offer performance advantages over software virtualization.[19]

OS VIRTUALIZATION

In operating-system-level virtualization, a physical server is virtualized at the operating system level, enabling multiple isolated and secure virtualized servers to run on a single physical server. The "guest" operating system environments share the same running instance of the operating system as the host system. Thus, the same operating system kernel is also used to implement the "guest" environments, and applications running in a given "guest" environment view it as a stand-alone system. The pioneer implementation was FreeBSD jails; other examples include Docker, Solaris Containers, OpenVZ, Linux-VServer, LXC, AIX Workload Partitions, Parallels Virtuozzo Containers, and iCore Virtual Accounts.

I was wondering if there is any security advantages of using one of these types over the other?

I also am curious, if there is one type of VM that is more secure than the others, if there are specific VMs we should be looking at, i.e., is there some specifics we should look to be the most protected, or are all VMS pretty much the same?

In this link https://superuser.com/questions/327224/how-can-i-safely-open-a-suspicious-email

There was an answer about using "Sandboxie" and there was a diagram included to mention what it does, and how it protects you, which got me curious if this is how they all pretty much work, or if there are certain specifics we should make sure to look into before using one of these VMs?

Improve this question

3 Answers 3

Reset to default
1

In the absence of bugs in any of them, they should all give similar security guarantees, though the "OS Virtualization" (jails, containers) should give the best performance as it removes the need for multiple operating systems, is quick to start, and allows the single operating system to share all of the machine's resources more effectively. (Modern operating systems use all otherwise-unused RAM as a filesystem cache. When you run a second OS in a VM, you have to give it a specific amount of RAM. The virtualized OS will use all of that RAM, and has no way to give up some of the RAM as "unused" to the host system to let the host system use it as it wants.)

However, OS Virtualization (jails, containers) gives the untrusted code access to the host OS's kernel, which is a large surface area where privilege-escalation vulnerabilities are often discovered. Privilege-escalation vulnerabilities are more rare in Full/Hardware virtualization systems (Virtualbox, etc).

Improve this answer
6
  • So it sounds like OS virtualization still is very risky due to shared Kernel?
    – XaolingBao
    Jan 11, 2017 at 2:59
  • Bare metal virtualisation gives the best performance because of a lack of overhead. A bare metal hypervisior as seen with ESXi is in deed faster. This seems to fit the description of "FULL VIRTUALIZATION".
    – dark_st3alth
    Jan 11, 2017 at 3:28
  • @dark_st3alth This may depend on the amount of physical ram etc. available. With limited resources, container based virtualization should be more efficient, as it doesn't require multiple OS's to be loaded at once.
    – user1751825
    Jan 11, 2017 at 3:53
  • @dark_st3alth Jails and containers are basically just processes running in the host operating system. There's way less overheard to them than the overhead involved in running an additional operating system simultaneously in a traditional full virtualization setup.
    – Macil
    Jan 11, 2017 at 22:04
  • @AgentME The issue is that while they do run as processes, you have an entire OS running in the background which has to also manage user input. ESXi is very much cut down, reducing the overhead for virtualization for not only the machine but also each virtualizated instance. A type 2 hypervisor puts an additional layer in between the guest and host. A type 1 does not.
    – dark_st3alth
    Jan 11, 2017 at 22:09
0

There are published (and unpublished) vulnerabilities that allows software to escape guest environments under any form of virtualization.

Remember, there still has to be a system in place to allow an operating system to request resources. As with ESXi, this can be with the hypervisor itself, which manages requests from multiple operating systems which run at the same time. While it certainly is much harder to do so under hardware instruction supported virtualisation, it does not stop containment issues.

The downside of using bare-metal hypervisors is that it dedicates the machine to that task, and an OS may only be remotely accessed. That is why software solutions like VMware's Workstation or Player are popular as they allow a user to use a familiar OS such as Windows/Linux while running another OS inside another window. Many modern choices support hardware virtualization instructions speeding up the guest OS.

A bare metal hypervisor should give the best security (and performance) as it enforces fencing of guests at both a hardware and OS level. Software solutions while many include use of hardware instructions, are unable to strictly enforce fencing as it sits on top of the host OS.

Improve this answer
0

Sandboxie should usually be less secure, as it runs within the same kernel and is only limited to separated storage for settings and files. It's one layer of security.

A Virtual Machine runs it's own kernel plus has it's dedicated storage for files and settings, that's many more layers.

Also if the program hidden in the e-mail tries to harvest info on you to prep for an actual attack, in Sandboxie environment they will learn the version of your main OS, while on VM they will see only VM OS.

There are zero-day exploits in software and used libraries that expose even VMs.

For best security you'd want to run a pure hypervisor system as your main OS and then run all other systems as VMs.

Check out Qubes OS it's one of its kind security and privacy Linux distro, made around VM technology but with aim of privacy. https://www.qubes-os.org/

Improve this answer
1
  • I modified to be specific to sandboxie, as that what the question was asking about at the end. The question itself is not about sandboxes in general (and not all sandboxes run on the same kernel). If that is not what you meant, then feel free to re-edit.
    – schroeder ♦
    Jul 20, 2018 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .