0

My host machine is running Windows 10. I've installed VirtualBox and use it to run an Ubuntu VM. Inside the VM I use Firefox to do all of my web browsing that doesn't involve entering sensitive data like important passwords, financial data or government id info.

I use another separate Ubuntu VM for just the following: - checking my email and social media - shopping from amazon and newegg

On my host (the windows machine) I use the paid version of Bit Defender Total Security to perform regular scans and it is configured to its default settings.

Finally for banking and logging into government websites, I use a separate (physical) Chromebook, which is exclusively for those purposes and strictly nothing else.

Is this all a good security practice? Or is it all just a lot of extra work for nothing?

Improve this question
2
  • Another option is to use Windows Sandbox.
    – msanford
    Jan 3, 2020 at 23:37
  • Windows Sandbox is good, Comodo Security Suit has a nice Sandbox, too, and a HIPS, this should be enough. FYI I saw different examples of code that checks if it is run inside a Virtual Envoirement, like VirtualBox. It may be a big difference between your "standart trojan" and an exploit aimed at virtual box envoirements
    – clockw0rk
    Jan 4, 2020 at 6:19

3 Answers 3

Reset to default
2

It's not exactly efficient and my gut feeling is it may increase attack surface. General browsing on generic sites means the potential for vulnerabilities to be exploited firstly on the website to serve malicious content and secondly by your client to be exploited. With your setup, it would mean exploiting Firefox to run privileged code that exploits an issue in Virtual box which could then potentially gain root access in Windows, which is a similar amount of work to exploiting an issue in Firefox to gain unauthorised access in Ubuntu except that isues that just affect that VM don't translate to your other VMs/devices. Having a wholly separate device for your personal use is I do not think very different from having another VM, except for the risk of what is essentially the hypervisor being affected.

If you had a device separate for work then that may make sense as it's much harder to secure a network when bringing in external devices where those devices may consume content and have connections made in environments you cannot control. For your own personal private information an airgapped device which never connects to any network may be called for.

None of this acknowledged that if the site you're browsing is compromised internally it makes no difference as to how you are accessing that site. Instead, look at broader measures which are effective such as constant updates of software (your current setup might be ineffective if you aren't already doing this anyway), do not reuse passwords, enable two factor authentication. This seems much easier to manage, and generally systems that are easier to manage are more secure.

Improve this answer
2

I do think there are some benefits to this, although it is unclear if the reward is worth the trouble. There isn't much of a "factual" answer to this, since it is really up to you how much effort you want to spend.

It is widely known that modern desktop OSes pale in comparison to mobile when it comes to end-user security. On your computer, your web browser and other applications you install have read/write access to all of the files that you do (for the most part), while on mobile devices, permissions are much more granular. Your solution somewhat addresses this issue; a compromised browser or machine only affects files and activities related to that instance.

While hypervisor vulnerabilities have happened, I imagine as long as your system and hypervisor are kept up to date, the virtualization shouldn't really add much attack surface.

Also, keep in mind that your email account that you access from your other VM may be just as sensitive as your banking and government websites, since it is likely the account recovery vector for these services.

Another benefit that you may not have considered is privacy. Since you don't perform all online activities from the same browser, you are less likely to be tracked by advertising networks and other data collectors.

In summary, it is up to you. If you are already doing this and it's not too much of a burden, I don't see a reason to stop.

Improve this answer
0

I would suggest using a VPN-TOR-VPN layer for added security which will be must more beneficial than added VM's and physical machines. Also, to make sure that VPNs you are using are paid ones with a No-log policy and are paid off using virtual currency than fiat. Moreover, being safe on the internet is a constant process and have to be a habit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .