4

If I want to check out a dodgy link from a friend, I've started opening these in a virtual machine. I'm assuming that if the VM gets hacked, the host where I do internet banking etc will still be fine. Under what circumstances does this assumption hold?

e.g. I can imagine shared folders and a shared clipboard could potentially be used to attack a host once an attacker has control of a VM. Possibly shared access to USB ports could be another vulnerability. Is this realistic, and are there any other things to be aware of? How paranoid would I have to be before worrying about this kind of threat model?

My question is primarily about VMs installed on desktop hosts, but information on potential threats to cloud hosting services would also be interesting.

Improve this question
1
  • 2
    VM software as well as the hardware hypervisor involved aren't inherently perfect. There have been numerous isolation breaches, working on many different mechanisms, usually far far more low-level than what you think about.
    – Marcus Müller
    Commented Sep 9, 2017 at 10:03

1 Answer 1

Reset to default
3

An advanced attacker could compromise a hypervisor through emulated device drivers more easily than through clipboard handling. The way a hypervisor works is by providing a new execution environment for a guest, and exposing emulated hardware. When a driver in the guest tries to access the virtual hardware by, for example, reading and writing to PCI BARs to interact with PCI devices, the hypervisor's emulated device software will hear the request, temporarily pause the running guest, and emulate in software what the actual hardware would have done before unpausing the guest and allowing it to see the results. This allows the guest to be effectively unaware of its underlying virtual environment. When you think of the emulated devices as acting merely as a proxy, implementing a complex and often poorly documented protocol between the guest software (which is designed to talk to real hardware) and the host hardware (which is capable of listening to software), it's easier to see how a bug in the parsing of such complex data structures could result in a security breach.

This is a look into some of the security caveats of a hypervisor, specifically QEMU with KVM, though the general concepts should apply to pretty much any hypervisor software.

Note that most of the time, exploiting a bug in emulated devices requires the attacker to have privileged access to the guest. They have to completely compromise the guest before they are even allowed to interact with the emulated hardware. If the guest itself is sufficiently secure, then the hypervisor will likely be, as well.

The full version of the famous quote from Theo de Raadt, founder of OpenBSD:

x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit.

You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

You've seen something on the shelf, and it has all sorts of pretty colours, and you've bought it.

That's all x86 virtualization is.

In the end though, the chances that a "dodgy link" will contain a hypervisor-breaking 0day are pretty remote. If anything, it'll have an exploit for an old version of Flash, used to download botnet software.

Improve this answer
2
  • Wow, I was really naive on this one. Now that you explain it (very understandably, thanks for that) it's kinda obvious that virtual machines are just software, with vulnerabilities like any other. Good to know that it's most likely not relevant for untargetted malware. It makes me wonder about cloud services though... if I set up a VM with a cloud service provider, I have privileged access, right? So there's potential there to attack the host server, and go from there to other VMs that they host?
    – craq
    Commented Sep 10, 2017 at 20:50
  • 2
    Yep. Exploitation of "cloud" providers is not at all uncommon. Sometimes an attack allows full privileged access to all VMs (privesc). Sometimes it allows the attacker to read data off of other VMs (infoleak). Sometimes it merely allows them to crash all the other VMs (DoS). It's a pretty big problem that those service providers (and their customers) have to deal with. Even worse, without any exploitation at all, an attacker can still cause some infoleaks via "cache side-channel attacks" like flush+flush and prime+probe. They are caused by a fundamental issue with the x86 instruction set.
    – anon
    Commented Sep 11, 2017 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .