460
votes
Accepted
What makes Docker more secure than VMs or bare metal?
No, Docker containers are not more secure than a VM.
Quoting Daniel Shapira:
In 2017 alone, 434 linux kernel exploits were found, and as you have seen in this post, kernel exploits can be ...
- 52.8k
134
votes
Accepted
If malware does not run in a VM why not make everything a VM?
One has to take into account why the malware is doing this distinction in the first place.
Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...
- 196k
92
votes
Accepted
Company computers for competent developers, how can you deal with them?
Separate development and production
It is usual practice to give developers local admin / root rights on their workstation. However, developers should only have access to development environments and ...
- 33.1k
83
votes
What makes Docker more secure than VMs or bare metal?
Saying either a VM or Docker is more secure than the other is a massive over simplification.
VM provides hardware virtualization; the hypervisor emulates hardware so that the guest kernel thinks it ...
- 31.3k
66
votes
Accepted
If a container is compromised does that mean host also compromised?
If the kernel is compromised in the container, the host is compromised.
Ostensibly, a compromised container should not be able to harm the host. However, container security is not great, and there are ...
- 66.3k
65
votes
Would a VM such as Virtualbox be my best option for everyday security while working?
By using the same VM for browsing, word documents, and email, you are exposing all of your data to the same level of risk.
Instead of doing all of this activity in the VM, consider doing your ...
- 34.1k
43
votes
Company computers for competent developers, how can you deal with them?
So this answer is from the point of a developer. Keep that in mind.
First, not having "local admin" rights on my own machine is a sign that I should look for a job elsewhere. It's nearly ...
- 1,546
37
votes
Why can hardware assisted virtualization be a security issue?
My research suggests that you have misinterpreted the meaning of the setting, e.g., see
this thread.
Avast is capable of using hardware-assisted virtualization to provide better anti-virus ...
- 1,667
37
votes
Accepted
Norton detects intrusion attempt from virtual machine - how is this possible?
You are assuming that the intrusion is coming from the VM to the hypervisor. A VM "breakout" is when the VM accesses the host directly.
An infected VM that has access to the network can ...
- 127k
33
votes
Is a Windows XP virtual machine with no network connection safe from hacking?
No - because your VM is inside a machine connected to the Internet it is not safe.
It is protected, yes, but that protection is only as good as the protection the host machine provides.
An attack ...
- 61.5k
27
votes
Accepted
Why can hardware assisted virtualization be a security issue?
In theory, hardware-assisted virtualization can make hypervisor-based rootkits possible. However, this type of malware already requires extremely high privileges and is not a particular threat. ...
- 66.3k
26
votes
Accepted
Meltdown and Virtual Machines
The references you mention don't conflict with each other. The first one claims for Meltdown that "Fully virtualized machines are not affected". The second one claims that the product is "vulnerable ...
- 196k
24
votes
What makes Docker more secure than VMs or bare metal?
As you correctly stated, Docker uses "Operating-system-level virtualization". You can think of this (if you are a *nix fan) as a fancy form of chroot.
By harnessing features and functionality built ...
- 3,032
21
votes
Accepted
Can .ova file contain an exploit?
Whether or not it contains an exploit, specifically, is irrelevant in the broader question of whether an OVA file can be malicious. The answer to the broader question is yes, absolutely.
The Open ...
- 134k
20
votes
Accepted
How do big cloud providers guard against VM escape attacks?
Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is ...
- 291
19
votes
Company computers for competent developers, how can you deal with them?
From a developer's point of view:
Your job is to prevent change (known bugs and vulnerabilities are better than unknown, right?), but mine is to change things. This puts us at an impasse. My job is ...
- 191
18
votes
Would a VM such as Virtualbox be my best option for everyday security while working?
In context of a Windows setup, a hypervisor such as VirtualBox, VMware helps isolate your guest from the host (the main installation of your OS).
This is a considerate move in terms of Security, if ...
- 336
16
votes
Can .ova file contain an exploit?
Any file can contain an exploit.
Whether it works or not, or if it requires a loader, is another story.
For example, if there's a buffer overflow vulnerability in the processing of .ova files, then ...
- 22.6k
16
votes
Should Virtual Machines be patched for Meltdown and Spectre?
My understanding, first off, is that the OS / hypervisor patch only mitigates Meltdown, not Spectre.
Second, you patch the hypervisor to prevent a VM from reading memory belonging to the kernel of ...
- 58.6k
15
votes
Accepted
Is a VM safe to run a simple virus on?
The default settings for most VMs will be sufficient for keeping everything isolated, that's what they're designed for.
The specific settings might be a little different depending on what software ...
- 301
15
votes
What is hacking hackable virtual machines useful for?
Think of hacking virtual machines to be the equivalent of being in a shooting range but for pentesting/offsec. It is all about practice.
In the real world, how are these practices of hacking ...
- 1,676
15
votes
Can a website keylog you outside a virtual machine
TL,DR: Don't be worried, you are probably safe.
Usually malware cannot escape the VM onto the host OS. There are exceptions, as some malware are designed specifically to break from the VM into the ...
- 52.8k
14
votes
Company computers for competent developers, how can you deal with them?
A security engineer doesn't maintain computers, that's what the service desk does. In your case you will require him to install three tools:
a hypervisor
docker
database software
From there he can ...
- 54.3k
14
votes
Is a Windows XP virtual machine with no network connection safe from hacking?
It is as safe as a Windows 8.1 machine with an internet connection.
Since the VM has no network, the only way to access it would be through the host machine. If the host machine is compromised, you ...
- 350
14
votes
What makes Docker more secure than VMs or bare metal?
I agree with ThoriumBR's answer if we're just comparing a blank VM with a blank Docker container. It should be noted, however, that properly configuring your system such as in Red Hat's Atomic Host ...
- 443
14
votes
If my machine is infected and I run a Virtual Machine inside of it, will the VM also be compromised
I believe you are asking the wrong question.
Whether or not your VM is infected is an open question. To answer it, you can inspect the malware, inspect the VM, draw conclusions, make a guess. But you ...
- 10.2k
13
votes
What makes Docker more secure than VMs or bare metal?
Docker Containers are Not Inherently “More Secure” But the Ability to Quickly Spin Up—and Destroy—Duplicates in a Cluster Is Very Useful from a Security Standpoint.
Okay, lots of other answers here ...
- 1,184
11
votes
Is this powershell script an infection?
It decompresses just fine for me... I converted the Base64 string into binary, then ran gunzip on it (I am using a Linux system here). This results in another piece of PowerShell that does things ...
- 172k
11
votes
Does Docker provide the same security as a vm
Theoretically, the isolation of Docker is not quite as strong, because parts of the system are shared (kernel is shared, container has a chroot of the original filesystem, etc). However, for most ...
- 315
Only top scored, non community-wiki answers of a minimum length are eligible