Is it possible that Oracle places backdoors in VirtualBox that compromise a user's privacy/anonymity? For example, is running Whonix through VirtualBox a secure set up if your host OS is unencrypted? How likely is it that Oracle can break out of the VM and "silently" gain root access to the underlying OS? What precautions can be taken to minimize these threats? Are there any viable alternatives?
I just put some opinions from this link:
If they wanted to include backdoors in VirtualBox, they would've closed the source a long time ago. Why would they spend time implementing a backdoor in open-source software that, if ever detected, would pretty much lead to everyone abandoning the software en masse? Leaving it open allows potentially thousands of individuals to comb through different areas of the source as they look for bugs and compile it on their own. There are too many eyes on it for me to buy into the notion of backdoors being likely. Yes, it's still possible. Anything is possible if you want to speak in technicalities.
You can download the source, review it, and compile it yourself.
Generally, yes, a backdoor is possible in any kind of software.
Yes it is possible but if the guest OS is installed in a TC container they need a backdoor also in TC before they are able to have access to the guest OS, and atm i dont think TC has backdoors, even if in these weeks some users are investigating about that.
and also this Virtualbox Programming Guide and Reference
that says: – there are no hidden backdoors into the virtualization engine for our own frontends.
but I think nobody can prove his/her opinion.(the answers are opinion-based not expert-based)
If you can not trust your virtualisation software, you're in deep trouble. The virtualisation software can do *anything it wants) to the virtualised code (due to direct memory manipulation) but this is at the level of "Hey, can someone steal my creditcard data even if I encrypted it from memory when the memory is full of measurement probes?" (a.k.a. you could, but its highly unlikely).
As @ali pointed out, Virtualbox is open source and you (or anyone) can inspect the code and see if such a thing is there. I haven't seen a call home routine during my network scans so I do not think it is there. And even if it would be as @Ali also pointed out, if they are ever caught it would be a huge publicity nightmare and Oracle could risk their reputation and business in the server market (that alone I think is motivation enough for them to never even try to implement something like that).
This by no means is a solid answer (I'd rather leave this as a comment than an answer, but I do not have the proper reputation). Depending on the network settings of your VirtualBox, if someone somehow got control of your VirtualBox, they could possibly get into your router or other devices on your network depending on settings and situation. Not to mention, if you are sharing folders with the VirtualBox, they could insert a malicious file and do some social engineering such as replacing a file in that folder with a file that looks similar (same filename, icon, and file data), but is actually malware. Nevertheless, common sense tells us that if anyone were to gain access to our VirtualBox, there is the potential for real damage to be done. As for backdoors, @Ali covered that excellently.