1

I am working with several maintainers of Homebrew currently to verify that several programs in the cask library now ship from the developer with trojans. To verify the claims I created a Virtual machine in Oracles Virtualbox running Elementary OS (linux based on debian).

From there I downloaded the suspected files and uploaded them to virus total (https://www.virustotal.com/gui/file/71e362921a19923d8cd19052641718b91b8c967aa1b0f277e7732c2901a6234b/detection). I downloaded both the Windows exe file and the Mac dmg file. The Windows file came up with malware but I was unable to check the Mac version do to a large file size. Following this I deleted the Virtual Machine.

Is there a chance that this DMG, which is possibly infected, could attack my computer which is running MacOS? Clearly the windows exe wouldn't be an issue but what about the DMG?

2
  • 1
    I don't see any mechanism for host attack based upon your description. Nov 20 '20 at 1:01
  • Also, don't just think a malware, especially if you have no knowledge is not going to try and looking for routes... so look into sandboxing solutions out there. The bird solution is what I have used in the past.
    – SysRisk
    Nov 20 '20 at 3:00
1

Virtualbox provides sandboxing by creating entirely new virtual system inside your host system. Its isolates the virtual system from the host machine, any thing you do inside the VM won't directly affect your host system, unless there is some host-only communication which probably gives some worm to try to attack your host system. But as long as you did not install the infected package in the first place, it will be okay.

5
  • Makes sense. Perhaps a simple question, is it possible for a malicious download/upload in virtualbox to interfere with a legit download on my main system? At the same time I was downloading a program and want to make sure if wasn't compromised.
    – Harrison G
    Nov 20 '20 at 1:13
  • 1
    Nope, doing such thing requires an attacker-controlled node between your system and the server, also called Man-in-the-Middle attack. Also I guess you were downloading from HTTPS-enabled website, so its unlikely such thing can happen. Nov 20 '20 at 1:17
  • 1
    Also Virtualbox VM is a system INSIDE your host machine, not between your machine and the server. Nov 20 '20 at 1:18
  • Could I also add? Elementary OS makes then when you click on a file it automatically tries to run this. I made this mistake and got an immediate error says the OS does not support exe. Have there been known viruses that cause exploit linux through exe without installing? Or for the DMG I compressed it to fit on virus total.
    – Harrison G
    Nov 20 '20 at 8:06
  • 1
    1. Windows and Linux runs on entirely different architecture, so afaik such kind of attack is impossible. 2. DMG is just a disk image/archive which contains the installer inside, as long as you didn't run the installer I guess it will be fine Nov 20 '20 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.