0

Let the diagram below be a representation of a LAN.
- let R be the interface between the LAN and the internet.
- H be host connected to the LAN.
- F be a firewall implemented using a virtual machine controlled by H.
- V be a virtual machine controlled by H.
- F is also the interface between the LAN and V.
- F also blocks all traffic from V destined for H.

    R
    |
 +--+--+
 |     |
 F     H
 |
 V

Consider:
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

How secure is this?

I know the user will be largely responsible for most breaches, like reusing passwords, or pulling files out of V, or using a VM that V can escape; but, aside from user error, is H safer?

Since V will be doing most of the insecure stuff, I can only see attackers targetting V because V is the only one that's out there that they can identify. Any viruses/attacks from V would be blocked completely by F if F is set to block all traffic on the LAN between them too. So, yeah, come break this setup.

I want to know if separating insecure activity with secure ones can make a host safer.

--- edit

So, probing the network will unveil H. In terms of V getting infected, though, can any of its infections reach H?

And yeah, H should be behind a firewall of its own.

2 Answers 2

1

No, I think V is safer than H. For H you are going for the security-through-obscurity approach, which is always discouraged.

This is because, in my opinion, your assumption that attackers targetting V will not come across H is faulty. For example, most of the latest worms don't only attack a single target system but also try to discover the target networks' topology and neighbouring hosts. So in my opinion it will be better if you take H behind the firewall too and don't expose it directly to the internet.

4
  • I thought worms had to infect first before they can hunt for hosts on the same network. If so, worm activity inside V cannot pass through F. In any case, yes, H needs its own means of protecting itself as well. Mar 21, 2014 at 17:16
  • No, thats not necessary. For example most modern worms will never just attack a single IP address but will port scan all IP addresses in a target subnet.
    – xkcd
    Mar 21, 2014 at 17:32
  • Kk, so when V does something insecure, V is also putting the entire LAN in danger. Mar 21, 2014 at 17:36
  • Exactly, because for worms its not a big difference to scan 1 machine or 255 machines. In fact, they will be even more agressive and scan 512 machines, what do they have to lose :)
    – xkcd
    Mar 21, 2014 at 17:48
1
Consider:
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

You may have this thought/theory inverted. On a flat line it looks like this:

Host (does all secure/private activity) --> router --> internet

There is no firewall mention here. Where if it were me, I would do:

Host --> proxy server (locked down w/IPS, AV, etc) --> router --> internet

Then you state:

Host --> Virtual (casual) --> gets firewalled here? --> back to host --> or gets firewalled here? --> router --> Internet

If V is not important, why bother wasting time and resources doing any filtering?

If you're that concerned about say banking, why not just use a bootable Linux cd whenever you're going to do something you perceive as mission critical. OR... Just throw up a proxy server running IDS, IPS, say Squid, and a firewall. I don't get your logic.

--- EDITED BASED ON OP's RESPONSE:

I think that you are going a bit overboard here. If you had a strong proxy, you wouldn't need to worry about a lot of attacks, since you would be able to strip data as it comes in, before it's even run in your network.

For example, with Squid used as a web proxy, you could do re-writes to remove java, javascripts, iframes, flash, etc., this greatly reduces the web attack vector. You can use YARA to further minimize as well. Which brings up another question / comment. If V is NOT that important, and used for casual things, why not just use a bootable version of Linux/BSD for THAT machine? That in itself removes a LARGE attack surface.

2
  • F means to filter traffic from V to H, so that V can't directly target H if V is compromised. Mar 21, 2014 at 17:50
  • "remove js, iframes, flash..." : very secure, but the set of working sites will be... small.
    – Jeff K
    Feb 24, 2017 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .