1

Using VirtualBox is it possible for VM escape to happen while using Whonix Gateway to connect to TOR and then use another VM with, let's say, Ubuntu (that uses Whonix instead of directly using the host's internet access) as my workstation?

What is the probability of this to happen?

Improve this question
2
  • It depends on what you do and download etc on the VM...
    – Sir Muffington
    Feb 25 at 13:35
  • @SirMuffington mp3 audios, mp4 videos, pdfs. Can these files contain malware to exploit the player / reader and then led to a VM escape?
    – Matheus
    Feb 25 at 13:37

2 Answers 2

Reset to default
1

Using VirtualBox is it possible for VM escape to happen while using Whonix Gateway to connect to TOR and then use another VM with, let's say, Ubuntu (that uses Whonix instead of directly using the host's internet access) as my workstation?

Yes.

What is the probability of this to happen?

100% on a long enough timeline.

VM escape is relatively rare on well maintained systems (software kept up to date). It can become less rare as systems fall out of date either due to user negligence or a software product losing support from it's manufacturer. Therefore, on a long enough timeline and with continued use, one of the two will happen and a VM escape will increase in probability until it happens. But even in the best of cases, there may be a 0-day in the VM that neither the user nor the maintainer knows about.

But there are takeaways in this:

  • Keep the VM up to date.
  • Cease use of a VM when it is no longer supported by the company/community behind it.
  • Accept the inherit danger in downloading random files from sketchy parts of the internet/deep web/etc. There is no strategy with certain safety, just differing levels of risk.
Improve this answer
1

A VM escape is always possible, there's nothing forbidding that to happen. But it's not probable. A VM escape exploit is very valuable, and would not be used against a low value target (or a random guy). And as soon as a VM escape exploit is found, the developers work to plug the hole.

As long as you keep both the host and the VMs updated, the probability is close to zero. If all you do is to watch videos and read documents, you could use your Whonix to download the files, copy them to a USB drive, and read the files on another offline computer.

And operation security blunders explains almost every case of users unmasked while using a VM, not VM escapes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .