3

Is it possible that Oracle places backdoors in VirtualBox that compromise a user's privacy/anonymity? For example, is running Whonix through VirtualBox a secure set up if your host OS is unencrypted? How likely is it that Oracle can break out of the VM and "silently" gain root access to the underlying OS? What precautions can be taken to minimize these threats? Are there any viable alternatives?

closed as too broad by schroeder, RoraΖ, Eric G, Dog eat cat world, Stephane May 8 '15 at 9:33

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    While I don't think Virtualbox has any backdoors, have you thought about your host OS running it ? I assume you're running Windows (otherwise take a look at QEMU which is light-years ahead of Virtualbox), and there's a possibility this OS is backdoored and thus can see and log everything you do in the VM. – user42178 May 7 '15 at 11:38
  • 2
    If you want a "secure" machine, just buy an used laptop (in my country a good Thinkpad can be bought under 100 bucks if you don't mind the battery being worn out), depending on your requirements you may remove wireless hardware and the hard drive if you don't need persistent storage (and boot off a CD or USB stick with your anonymity-focused distro of choice). That way you get full anonymity (assuming the distro itself is good), without the risks of having a backdoored OS nor the performance impact of virtualization. – user42178 May 7 '15 at 11:41
  • You really are asking several questions in one, here. It would be better if you could separate the question about how a VM Monitor can control a virtualised OS from the question about whether and how a host OS can be affected by a userland VM Monitor. The two discussions are too different for me to give a single answer and recommend any course of action. Also, it's always a good idea to tell us more about your use case, since your question is about whether VirtualBox can be trusted for that specific use case. – Steve Dodier-Lazaro May 7 '15 at 15:08
4

I just put some opinions from this link:

If they wanted to include backdoors in VirtualBox, they would've closed the source a long time ago. Why would they spend time implementing a backdoor in open-source software that, if ever detected, would pretty much lead to everyone abandoning the software en masse? Leaving it open allows potentially thousands of individuals to comb through different areas of the source as they look for bugs and compile it on their own. There are too many eyes on it for me to buy into the notion of backdoors being likely. Yes, it's still possible. Anything is possible if you want to speak in technicalities.

You can download the source, review it, and compile it yourself.

Generally, yes, a backdoor is possible in any kind of software.

Yes it is possible but if the guest OS is installed in a TC container they need a backdoor also in TC before they are able to have access to the guest OS, and atm i dont think TC has backdoors, even if in these weeks some users are investigating about that.

and also this Virtualbox Programming Guide and Reference

that says: – there are no hidden backdoors into the virtualization engine for our own frontends.

but I think nobody can prove his/her opinion.(the answers are opinion-based not expert-based)

1

If you can not trust your virtualisation software, you're in deep trouble. The virtualisation software can do *anything it wants) to the virtualised code (due to direct memory manipulation) but this is at the level of "Hey, can someone steal my creditcard data even if I encrypted it from memory when the memory is full of measurement probes?" (a.k.a. you could, but its highly unlikely).

As @ali pointed out, Virtualbox is open source and you (or anyone) can inspect the code and see if such a thing is there. I haven't seen a call home routine during my network scans so I do not think it is there. And even if it would be as @Ali also pointed out, if they are ever caught it would be a huge publicity nightmare and Oracle could risk their reputation and business in the server market (that alone I think is motivation enough for them to never even try to implement something like that).

0

This by no means is a solid answer (I'd rather leave this as a comment than an answer, but I do not have the proper reputation). Depending on the network settings of your VirtualBox, if someone somehow got control of your VirtualBox, they could possibly get into your router or other devices on your network depending on settings and situation. Not to mention, if you are sharing folders with the VirtualBox, they could insert a malicious file and do some social engineering such as replacing a file in that folder with a file that looks similar (same filename, icon, and file data), but is actually malware. Nevertheless, common sense tells us that if anyone were to gain access to our VirtualBox, there is the potential for real damage to be done. As for backdoors, @Ali covered that excellently.

Not the answer you're looking for? Browse other questions tagged or ask your own question.