0

Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus).

How vulnerable is in this context a VM with a not up to date windows OS and an old and not up to date antivirus? 1)

What factors (if any) affects this? Internet access, VM guest settings, etc.

1) Let's say you have a an old VM you need to work on, for which an update would have a significant cost, or not be possible (legacy applications support, or simply the VM scope is to test an application in that specific environment).


Apparently my question is not clear enough. So let me rephrase it like this: You have a system A that is safe from wannacry (i.e. it is patched and it cannot get infected, has up to date antivirus). You have a system B, which, on it's own is not safe from wannacry (i.e. not patched, it can get infected, old antivirus definitions). If you run system B as a VM inside system A, can B still get infected, or does the fact that it runs as a VM inside a secure system blocks the attack vector? Can the A's antivirus prevent wannacry from entering B?

5
  • 1
    "internet access" is not the important point. Is the SMB port exposed by the host to the VM?
    – schroeder
    May 19, 2017 at 8:26
  • @schroeder I don't know what that is. It's an old VM created by another. I just open it (VMWare Player) and work in it. But I don't want to particularize to this. It would be more helpful to have an answer along the line: it's vulnerable if (condition, configuration etc.) or it's vulnerable no matter what. I'll edit the question
    – bolov
    May 19, 2017 at 8:51
  • @schroeder ok, did a bit of reading. Ran Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol but even with import-module servermanager I get "The term 'Get-SmbServerConfiguration' is not recognized as the name of a cmdlet..." (server 2008 R2). But debugging that it's not the point of this QA.
    – bolov
    May 19, 2017 at 9:11
  • 1
    The answer is my first comment: is the SMB port of the VM exposed to the internet by the host?
    – schroeder
    May 19, 2017 at 9:18
  • 1
    "it is vulnerable if the unpatched SMB port is exposed to the Internet by the host"
    – schroeder
    May 19, 2017 at 9:19

2 Answers 2

1

TL;DR - Treat a VM as if it were a physical machine just like any other.

The presence of security patches on a host will not prevent the client VM from being vulnerable.

WannaCry has 2 infection routes -

  • Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit
  • Infection through SMB exploit when an unpatched computer is addressable from other infected machines

Source: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

So in other words, the VM is vulnerable IF another machine in your environment gets hit by WannaCry and the VM has any SMB services enabled (and most do even if it's only the "admin" file shares like \\machine\c$).

-2

The simple answer to your question is: "An insecure VM in a secure host is vulnerable to wannacry"

Keep in mind that a VM is a sandboxed environment. The purpose of VM is to simulate the system it has been intended for.

The possible ambiguity in your question is "insecure VM in a secure Host ". No doubt the VM running in a host is still logically mapped as two devices (VM and the "secure host") in the network. You can use any network scanner to prove this result. Advanced scanners may map the VM machine to the HOST but nevertheless treated as a separate hardware.

Make no mistake about what exactly WannaCry is,

WannaCry is a ransomware, that encrypts file systems and propagates through network exploiting a RCE vulnerability. This is not the first appearance of wannaCry, we can confirm that this is a modified version of the previous W.Crypto ransomware by adding the leaked NSA Zero-day exploit for a worm-like characteristics.

The moment the VM's filesystem is encrypted by the W.cry's 2048-bit RSA, The result is that the WannaCry has succeeded, even if the propagation fails.

Since you haven't mentioned multiple VMs, and the host bounding the VM is secure, propagation is not likely. If there were multiple vulnerable VMs running within the same network or machine, again you can witness the propagation effect of WannaCry.

"The Factors affecting" is a really vague question. Our organization believes that, although wannaCry has a worm like feature, it is primarily a Ransomware. So it requires some Social Engineering to set itself up in the first Place. Like clicking a mail attachment, or a link to a website, clicking "OK" for an unknown application in the Windows UAC, etc.

Since you mentioned that your environment is secure and only the VM is vulnerable, you will have to trigger WannaCry only from the VM for it to infect it through any of the above.

I believe this answers the query, but a more accurate question would help us understand the scenario.

8
  • ty for the answer. Regarding the understand the vagueness of the question. In my mind the setup is simple: You have a host which, as in the first paragraph of my question, is "reasonably secure". And you run inside this host a VM for which you haven't taken any special steps to ensure it's security (unpatched windows version etc). My question is: Does the "security" of the host ensures that the VM cannot get infected, or can the threat infect the VM, bypassing the host security. You answered my question.
    – bolov
    May 19, 2017 at 10:46
  • @adib your facts on how it propagates are false - does not require social engineering
    – schroeder
    May 19, 2017 at 10:49
  • @schroeder any kind of user activity involved in the WannaCry case is treated as " Socially Engineered". As the malware didn't just aggressively scan every SMB port (139 or 445) in the internet. It starts the scanning process from within the host(victim). Now, How do you believe the malware creeped inside the network ?
    – Adib N
    May 19, 2017 at 11:05
  • @schroeder Only after reaching a saturation amount of compromised systems , can the WannaCry be spreading without vectors. To reach the this point, The attacker must either target scan a known IP or just employ some social engineering to filter-out potential victims and then automate the attack phase followed by the payload phase
    – Adib N
    May 19, 2017 at 11:10
  • According to a brief amount of research, it can spread via shared cloud drives, public wifi, as well as the 'local' network (which could include the Internet if SMB is exposed). So, sure, SocEng is a component but you make it sound like it's the primary initial vector. It is only one threat vector.
    – schroeder
    May 19, 2017 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .