16

All questions ask about the other way round, ie. can a virtual machine compromise the host. But I'm asking can a virus on the host machine compromise the guest virtual machine?

  • Im worried it will access private data on the virtual machine. – VirtualMachine May 17 '14 at 20:32
  • 1
    for curiousity's sake: did you have an idea or logic that would suggest otherwise, that means a concept/case in which a host is secured against its host? – humanityANDpeace May 18 '14 at 5:57
  • 2
    Your worry mentioned above is in the case that you rent a vm and the host is not in your control, right? – humanityANDpeace May 18 '14 at 5:59
  • 1
    In theory, homomorphic encryption could make it more than impractical for anything on the host machine to cause any undetected and undesired behavior in the virtual machine. But this is a new technique in practice. USPTO awarded IBM a patent only a couple of months ago. Another problem as I will wildly speculate is that perhaps the virtual machine thus protected could not function as a general-purpose stored-program computer without giving up that protection. – minopret May 18 '14 at 15:27
27

Yes, it can.

Any data stored on the virtual hard drives of the virtual machines is stored on the hard drive of the host system. When any VMs are in "suspended" state, their RAM content is also saved on the hosts hard drive. Any malware which can access these files can read and modify their content.

Another attack vector would be to target the hypervisor process directly and inject code into it. When one controls the hypervisor, one controls the virtual machines it executes.

A malware called Crisis has been spotted in the wild which targets virtual machine images on the machine it runs on. An attack from the host system circumvents most security features a guest system could have, which means that it would be almost impossible to harden a guest system against this kind of attack.

  • I think the most common way a virtual machine would be infected would be if a worm on the host machine is propagating over the network, and the virtual machine was connected to a virtual network setup by the host. That's not really an exotic scenario. – DCKing May 19 '14 at 15:42
  • I am not even sure almost impossible to harden applies, how would you start? assuming the infected host can access both the hard drive and the ram unnoticed? – user2813274 Jul 16 '14 at 20:22
  • @user2813274 There are technologies coming from the area of copy protection and game cheat prevention which can detect external modifications to an application. These could be applied in this context to make an attack from the host system at least a bit more complicated. – Philipp Jul 16 '14 at 20:42
  • @Philipp Ah, I was looking at it from the angle of protecting sensitive information mostly, rather than checking for modifications, but even then it is impossible to protect it, as the execution of that code can be paused, the code stripped out (or just bypassed), and then resumed – user2813274 Jul 16 '14 at 20:46
12

If a virus is on the host machine and operates as a normal/privileged user, and a normal/privileged user on that machine can use the virtual machine, there's nothing that prevents the virus from compromising private data from the virtual machine.

3

The security model of virtual machines does not protect or separate the guest from the host, quite contrary, access to the guest is facilitated in many ways: integration with the host (think VmWare unity), APIs that make guest management simple and automated, and shared resources (input devices, storage, etc.)

A virus you talk about is as unremarkable, so unremarkable that ends up being remarkable when it happens. There was a lot of media coverage when the first malware that infected virtual guests was first discovered in 2012.

When encountering a Windows-based PC, Crisis actively searches for VMware virtual machine images. When they're found, the malware copies itself onto an image using VMware Player.

It does not use a vulnerability in the VMware software itself, it takes advantage of an attribute of all virtualization software: namely that the virtual machine is simply a file or series of files on the disk of the host machine. These files can usually be directly manipulated or mounted, even when the virtual machines is not running.

Its aim is to get inside as many systems it can to steal the maximum amount of information.

The low number of infections and their wide geographic distribution could suggest that this malware is used in targeted attacks rather than widespread ones.

  • It's even more dangerous when a hypervisor process runs with admin privileges in order to access privileged host resources. Now, I'd love to see a worm infect its way out of multiple guest OSes into the host. It'd be a spectacle. – TheRealChx101 Sep 22 '18 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.