1

From time-to-time it would be useful to connect an untrusted USB device to my computer. If I could connect it directly to a virtual machine, bypassing the host. that would be secure enough for me. I realise that's not zero risk, but it would be good enough.

However, with VirtualBox, there's no obvious way to do that. If a device is connected to the host, you can reconnect it to the VM. But by that point it's too late - a USB keyboard could have entered malicious keystrokes, or a USB CD could have autorun malware.

Is there a way to connect directly to a VM? I'm happy with an answer that uses any virtualisation software.

|improve this question
  • what's your OS? (host and vm!) – F. Hauri Jul 16 '17 at 10:47
  • this is tangentially related to security - you are not even asking 'how to use it in a secure manor', you want to use a feature for security purposes - also, what you ask is impossible, the VM borrows resources from the host - you would need the hypervisor to reside above the host OS – schroeder♦ Jul 16 '17 at 10:51
  • @schroeder - understood, thanks for not closing. dunno how familiar with usb virtualisation you are, but once usb device is connected to a guest, reliance on hypervisor is minimal. malware or malicious key strokes go to the guest. – paj28 Jul 16 '17 at 12:08
  • @f.hauri - Windows 10 host. any guest, probably Kali – paj28 Jul 16 '17 at 12:10
  • @paj28 I'm familiar - but to set up the connection, the hypervisor is in charge - if you have a host OS, then that's your hypervisor layer - I'm sorely tempted to close – schroeder♦ Jul 16 '17 at 16:49
1

Well you have a chicken and egg problem here. For the hypervisor to give a USB device directly to a VM, it must first be able to identify it, by comparing its vendor id and product id with what is declared for the guest.

So you can (on recent VirtualBox versions on Windows hosts) pass an USB device directly to the guest with only a minimal action of the host(*) (just read ids but do not mount the device), provided you can be sure of the vendor id and the product id. But you cannot know that before you have mounted the device... And I have only used VBox on Windows, so I cannot say more for other host OSs

(*) According to its documentation, VirtualBox declares

On Windows hosts, a kernel mode device driver provides USB proxy support. It implements both a USB monitor, which allows VirtualBox to capture devices when they are plugged in, and a USB device driver to claim USB devices for a particular virtual machine.

|improve this answer
0

You are correct - it is almost always too late by the time the USB device reaches the Guest OS - especially if you're not using a bare metal hypervisor (e.g., as with VirtualBox).

More here: https://security.stackexchange.com/a/167206/149485

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.