Is a insecure VM in a secure host vulnerable to wannacry?

Question

Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus).

How vulnerable is in this context a VM with a not up to date windows OS and an old and not up to date antivirus? ¹⁾

What factors (if any) affects this? Internet access, VM guest settings, etc.

¹⁾ _{Let's say you have a an old VM you need to work on, for which an update would have a significant cost, or not be possible (legacy applications support, or simply the VM scope is to test an application in that specific environment).}

---

Apparently my question is not clear enough. So let me rephrase it like this: You have a system A that is safe from wannacry (i.e. it is patched and it cannot get infected, has up to date antivirus). You have a system B, which, on it's own is not safe from wannacry (i.e. not patched, it can get infected, old antivirus definitions). If you run system B as a VM inside system A, can B still get infected, or does the fact that it runs as a VM inside a secure system blocks the attack vector? Can the A's antivirus prevent wannacry from entering B?

Answer 1

TL;DR - Treat a VM as if it were a physical machine just like any other.

The presence of security patches on a host will not prevent the client VM from being vulnerable.

WannaCry has 2 infection routes -

• Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit
• Infection through SMB exploit when an unpatched computer is addressable from other infected machines

Source: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

So in other words, the VM is vulnerable IF another machine in your environment gets hit by WannaCry and the VM has any SMB services enabled (and most do even if it's only the "admin" file shares like \\machine\c$).

Answer 2

The simple answer to your question is: "An insecure VM in a secure host is vulnerable to wannacry"

Keep in mind that a VM is a sandboxed environment. The purpose of VM is to simulate the system it has been intended for.

The possible ambiguity in your question is "insecure VM in a secure Host ". No doubt the VM running in a host is still logically mapped as two devices (VM and the "secure host") in the network. You can use any network scanner to prove this result. Advanced scanners may map the VM machine to the HOST but nevertheless treated as a separate hardware.

Make no mistake about what exactly WannaCry is,

WannaCry is a ransomware, that encrypts file systems and propagates through network exploiting a RCE vulnerability. This is not the first appearance of wannaCry, we can confirm that this is a modified version of the previous W.Crypto ransomware by adding the leaked NSA Zero-day exploit for a worm-like characteristics.

The moment the VM's filesystem is encrypted by the W.cry's 2048-bit RSA, The result is that the WannaCry has succeeded, even if the propagation fails.

Since you haven't mentioned multiple VMs, and the host bounding the VM is secure, propagation is not likely. If there were multiple vulnerable VMs running within the same network or machine, again you can witness the propagation effect of WannaCry.

"The Factors affecting" is a really vague question. Our organization believes that, although wannaCry has a worm like feature, it is primarily a Ransomware. So it requires some Social Engineering to set itself up in the first Place. Like clicking a mail attachment, or a link to a website, clicking "OK" for an unknown application in the Windows UAC, etc.

Since you mentioned that your environment is secure and only the VM is vulnerable, you will have to trigger WannaCry only from the VM for it to infect it through any of the above.

I believe this answers the query, but a more accurate question would help us understand the scenario.