Is creating a network bridge in order to connect a virtual machine to the internet insecure?

Question

I have created a virtual machine using Hyper-V running OpenSUSE 13.2. In order to get an Internet connection on the virtual OS I created an external virtual switch. Windows 8.1 then automatically creates a network bridge between my WiFi adapter and the vEthernet (External Virtual Switch).

According to a warning on this Microsoft website, this is a bad idea:

Warning

You shouldn't create a bridge between an Internet connection and a network connection because it creates an unprotected link between your network and the Internet, which makes your network accessible to anyone on the Internet.

Is this indeed insecure and if so, is there an alternative method to ensure the virtual machine has an Internet connection while being secure?

Answer 1

The Short answer to this is Yes, its insecure.

To explain, you must first understand what a Bridge is. A bridge in it's simplest definition is connecting two or more networks together. I would say this basic concept has been muddied since bridging to a layperson has been obfuscated by "All in one" devices.

What you are essential doing is mapping the external internet connections to your internal Virtual Virtual Switch for your VM(s). This leaves the connection open and vulnerable.

Let get a little more realistic. You (like the the Security conscious person you are) probably have a route/firewall (Hell if you using Wifi at a coffee shop, they have some sort of protection). Now you are taking that connection to your laptop, and bridging it to your internal VM network.

The essence of what was stated by MS is true, but if you really care you need to look at the risk involved, are attackers really going be trying to hit your external ISP route, to get into your wifi bridge connection and past your SUSE FW (You are running that right?). Mostly likely not, if there going to compromise you its through email or drive by's on connection you establish.

In the off chance you are connected directly to the External Connection, you obviously are exposed, and dealing with issue is fairly similar to the how we deal with this problem today, insert a firewall between the two. You could, if you cared, setup a virtual FW (for free or purchased) which would protect that connection, by pushing the bridged connection to the Virtual FW, and on to your internal network.

Answer 2

To be honest, as far as information security is concerned, any device connected to the Internet is vulnerable.

Microsoft is correct in saying so. Imagine a scenario where you have multiple internal network nodes that communicate only internally. You decide to open up just one port on one node in the network to freely communicate with the external internet. This puts your entire internal network in jeopardy. Imagine if a hacker could gain access to the one "open" machine and infect your internal nodes, escalate privileges and gain complete control over the network. Big risk. So you see, any sort of insecure communication between two networks leaves in open to attacks. In your case, your "virtual network" is at risk since you have now configured an 'external bridge' that allows your "open" hyper-visor to communicate with your "virtual network". So an attacker can tunnel thru your hyper-visor or attack those machines directly if the attacker finds a way.

Unfortunately, "bridges" are the only way to channel IP traffic from your visor to your virtual machines. Securing these bridges forms an incredibly important part of your security policy. Strong policies with port security mechanisms can help mitigate your risks.