15

Sometimes I have to fix an infected WordPress website. I always check the infected website from a virtual machine (Oracle VM VirtualBox). I'm also running Norton 360 DeluXe on the host machine.

In the 2 most recent projects, for both, I received a notice from Norton that 'an intrusion attempt was detected and blocked', on the HOST machine. So apparently the malware can 'breakout' a VM? (Despite having read this article, that it should be totally isolated.)

As how can Norton otherwise detect this as the page was opened in the VM?

Also Norton says: No action required, is that really true? Could the host be infected with stuff Norton did not detect?

enter image description here

It does not feel safe anymore to use a VM to visit infected website. Should i be worried? Did i do anything wrong? What are the alternatives?

2
  • Could you be using the virtualbox NAT network? In this mode, the virtualbox program handles the traffic from the client, and the traffic passes though the hosts network space, though filters such as your anti virus. It is the safest option to use
    – Ferrybig
    Commented Feb 9, 2021 at 10:08
  • there has occasionally been bugs in both VMWare and VirtualBox that has allowed VMs to break into the host, but that's exceedingly rare, especially if you have an up-to-date version; i remember reading about one CTF contest where one of the flags required breaking out of a virtualbox VM using a real virtualbox exploit :D Commented Feb 9, 2021 at 16:33

1 Answer 1

37

You are assuming that the intrusion is coming from the VM to the hypervisor. A VM "breakout" is when the VM accesses the host directly.

An infected VM that has access to the network can attack the host's network. That's not a "breakout".

But the alert in your image is indicating that it saw traffic to a domain on a watchlist. That's not an intrusion or an attack on the host. Norton is inspecting traffic from the machine, which includes traffic from all VMs, and flagged the suspicous traffic. This is not a surprise, since you stated that the site was infected.

There is nothing in the info you provided to support your claim that there was an intrusion from the VM to the host...

9
  • 3
    @Peps As the question you linked to already mentions, a VM isn't perfect. I had a friend in the past who was an aspiring ethical hacker and he had configured the VM network in such a way that from the perspective of the host it was just another PC on the network. Next he intentionally installed a bunch of Bad Stuff™ and was completely shocked that one of those was a computer worm which ended up infecting the host. At the same time traffic passing through like the thing Norton noticed will not harm the host system in any way. Practically a VM is just another sandbox in addition to (cont.) Commented Feb 8, 2021 at 19:49
  • 2
    your browser. Either should be enough, although it all depends on what you do (=run) and your threat models (=how big a chance of infection is too big). Commented Feb 8, 2021 at 19:49
  • 2
    @DavidMulder, thanks for your comment too. Are you saying the Chrome browser for example is already a sandbox? (I did not know!) How far does its protection reach? Would you visit infected websites without a VM, just with your browser?
    – Peps
    Commented Feb 8, 2021 at 20:11
  • 7
    @Peps "infected website" is a pretty vague term in the first place which can range from "it shows ads/runs a js-bitcoin miner whose income goes to the account of the attacker" to "it installs software on your pc using an exploit in your out of date browser/software" (pretty rare nowadays) to "it installs software on your pc using a zero day exploit" (very rare). The latter is only relevant if you are a high value target and the second is about your own diligence (=never turn off auto update!). Most [citation needed] computer infections nowadays happen through user error/soc. eng. anyway afaik. Commented Feb 8, 2021 at 21:40
  • 4
    @Peps As for directly answering your question, Chrome more or less consists of an architecture that results in two layers of 'sandboxing' . In other words, typically you need two exploits to be able to escape the sandbox (=have a website get access to your pc without permission). At the same time exploits that allow escaping VMs are even rarer, as the 'audience' is far smaller, so running a (shady) website inside a browser inside a VM is still very very safe (unless you're the POTUS or something). Commented Feb 8, 2021 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .