There is a program that I wish to run under VirtualBox in order to avoid possibly infecting my computer because I am not sure I should trust the source. (Based on download location).

It is for interfacing with a device over USB. When I use Virtualbox's ability to connect to a USB device connected to my computer, is it possible for a program to use that to hop through to my actual computer OS?

  • I'm not sure what your question is. Is your question something like: "Can I safely bind to a USB device and isolate it in VirtualBox?" - Without possibly infecting the parent operating system? Also, can you describe more about the kind of program you want to run? – Bob Ortiz Aug 9 '17 at 21:12
  • If by parent you mean the one installed on the laptop, and bind you mean connect to virtual box. Then yes. The program is for flashing the os on a scientific calculator. – user173724 Aug 9 '17 at 21:14
  • unfortunately, this suffers the same problem: it's essentially a VirtualBox and OS question that's only tangentially related to securtity – schroeder Aug 9 '17 at 22:29
  • 1
    @schroeder his focuses on unknown hardware, while mine focuses on unknown software. My main worry is that since the USB connection is tunneled through the main os, this could be a way for the program to target the main os – user173724 Aug 9 '17 at 22:51

Short answer: No.

When you use VirtualBox, the USB device first connects to the host. Only then, through the VirtualBox drivers, the device is made available to the guests. This part cannot be circumvented because VirtualBox uses the Host OS capabilities for the most part (i.e., it is not a bare-metal hypervisor).

Most often, if there is a supported file system on the USB device, it is also auto-mounted, giving rise to further security issues. This part alone can be prevented in most OSes (by disabling automount). So if the malware depends on filesystem / file-related actions on the OS, VirtualBox could isolate the malware on the Guest OS (unless the malware uses VirtualBox-specific exploit to escape the VM and access the Host OS).

|improve this answer|||||
  • 2
    Does this mean the only way to safely assess a USB is to connect it to some air-gapped machine and accept that the machine may become infected? Then you have to format/reinstall that OS each time a new assessment is performed on a different USB (i.e., to ensure the assessments are truly independent)? What's the actual best practice for this type of USB security analysis? – ch-pub Jun 29 '18 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.