61

If the kernel is compromised in the container, the host is compromised. Ostensibly, a compromised container should not be able to harm the host. However, container security is not great, and there are usually many vulnerabilities that allow a privileged container user to compromise the host. In this way, containers are often less secure than full virtual ...


11

It depends. If it attempts to hide that it's an VM, it can be hard. This can be the case with for instance VM's used for analyzing malware. This paper from Symantec goes into some detail. In short, it's usually possible to detect, even if the VM, is trying to hide it, by running instructions to put the CPU in a specific state, and then run some instruction ...


5

Because containers are not as isolated as VMs, yes, in one way they are less secure. See forest's answer. Having said that, I think it's worth noting that containers also provide some some benefits from a application security perspective. Because they typically run a single process they limit the attack surface, there's no cron monitor or ssh daemon ...


3

It really depends on what is on the scope of "security". If service availability is part of security, then usually, virtualized system are better on this topic because of: the inherent mitigation of hardware fault. Ability to take snapshot, etc... to ease backups and rollback If availability isn't on scope, then i would tell that, for sure, physical ...


3

Depends on your threat model VM escape vulnerabilities are, in general, rare compared to other classes of vulnerabilities - there are less such vulnerabilities found each year than e.g. critical vulnerabilities in mainstream operating systems or their bundled components. Assuming that there currently aren't any known unfixed vulnerabilities for VMWare, and ...


3

VM's are an abstraction we refer to for convenience. The underlying reality is that it's all code running on the host. You can protect a non running VM file with encryption, but a running VM client is running on the host, with host memory and host CPU. The host has access to everything.


3

You are conflating a lot of concepts together, so let me try to separate them. Virtual machines are a convenience of many purposes but enhancing anonymity is not one of them. Yes using a browser in a VM will give different indicators such as User-Agent and Fingerprint, but that’s just another set of tracking variables. It’s extremely difficult to configure ...


2

Q: .. do the host as well as the guest need to have Meltdown/Spectre mitigation enabled? Yes When these vulnerabilities announced, QEMU posted on "QEMU and the Spectre and Meltdown attacks": Right now, there are no public patches to KVM that expose the new CPUID bits and MSRs to the virtual machines, therefore there is no urgent need to update QEMU; ...


2

you should check the Winbagility project which provides the VMI APIs for VirtualBox (called FDP for Fast Debugging Protocol). A library similar to libvmi has been written on top of it: icebox. I don't believe that they will make a libvmi driver for FDP. The reason is that they used VirtualBox because it is a cross-platform hypervisor, so no need to be ...


2

Answer: Low-level vulnerabilities, such as buffer overflows in the stagefright binary or underlying Linux kernel, will behave differently on every system that you run them on (ie: x86 Android, QEMU ARM, native ARM). Userland-level security vulnerabilities will be largely the same as they live at a high level of abstraction from the processor architecture.


2

The problem is that I didn't connect my Virtual machine to the bridge adapter, so I can't get access to it. I should've just add it in the VM's settings, and all started to work well!


2

The feature you named does not exist. What you're actually asking about is Windows Defender Credential Guard. This feature moves your passwords and derived credentials for Kerberos and NTLM used to communicate with services on the network into a separate secure virtual machine (VSM). The point of the feature is to make it more difficult for attackers to ...


2

The cloud you run your VM on is essentially the "hardware" for your system. As much as you don't have full control of the hardware you have at home you don't have full control of the virtual hardware in the cloud. As much as the vendor of your hardware at home might have placed a backdoor into your keyboard or into the BIOS etc the provider of the virtual ...


2

First, this is a pretty broad question since there are many virtualization technologies. So please don't expect an in-depth comparison of each of these. There are actually several resources on the internet which provide more detailed information, like Security aspects of virtualization from enisa. A simple Google search will provide even more resources. Thus ...


2

Despite your already accepting an answer, I'll add mine. Most importantly, us two factor authentication (2FA) with your bank! You need not dedicate a laptop to your banking. If you are worried about the laptop, use a bootable non-persistent OS, there are dozens of Linux variants or you could even use Windows-to-Go if you want Windows. This will bypass ...


2

Your security posture is likely somewhat weaker when running it in a VM. I recommend that you read the Qubes-Whonix security page, as it has some useful advice here. Running it in a VM means you increase your attack surface. Qubes-Whonix itself is designed to offer increased security, so running it inside a VM in a regular OS doesn't make much sense. You're ...


2

What you're looking to do, if I read your question correctly, is to isolate possibly hostile code to be compiled and run on a server you control. So you need some kind of sandbox/isolation to do that. The question you need to think about is "how much isolation do I need" Docker will provide reasonable isolation but it still exposes the Linux kernel on the ...


2

There's nothing "special" with AWS servers. If you can obtain the same exact operating-system image, you could use virtualization and a shared (preferably internal only) network to configure the network as same as AWS environment


2

What should I be doing to prevent the application from breaking when I hex edit the new name in? Should I be searching for something else beside SbieDll.dll to replace? In the 80s, it was possible to open a program binary with a hex editor and change strings (on computers such as Atari ST, Amiga, etc.) and even then the size of the string had to remain ...


2

No, not unless there were a critical VM-escape vulnerability in the VM hypervisor.


1

I opted for Cuckoo to automatize running the software on the guest machine and wrote a custom auxiliary analysis script to collect those metrics every second. The way to collect data is thus as secure as Cuckoo is so I guess better solutions could be found but at least there is a possibility to stream them as they are collected so that, in case of loss of ...


1

largest additional risk from a vm are the memory timing attacks of one vm can likely potentially be used to read memory from another. Spectre and Meltdown spring to mind. https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ for example Yes this can likely be mitigated, but at a performance penalty. Hypervisor security is not trivial. Obviously ...


1

If you think that the executable is potentially unsafe, It is always better to access it in a network isolated PC. Considering threats like the recent zero-day vulnerability in VirtualBox (read more). We can never be sure of what's out there already. You can run it inside a VM inside the isolated PC with proper firewall rules configured as a safety ...


1

There's no such thing as "verifying sterility" In general, there's no such thing as verifying sterility, instead you reduce the risk as much as is reasonable and assume the risk that remains. The usually accepted way to ensure sterility of some system is to restore it to a known good state instead of attempting to verify whether the current state is good. ...


1

In short: no isolation is the worst. Isolation by sandboxes is better but costs more resources. Isolation by containers is even better and costs even more resources. Isolation by VM is again better and costs again more resources. And isolation by hardware is even better and costs even more resources. Of course, implementation details are relevant and might ...


1

Use a virtual machine that can control a USB device, and that takes away control by the host machine, i.e. the host machine no longer sees the USB when it is inserted. Then transfer the files by cheap USB stick and physically destroy it afterwards (Or store it safely for future investigation) Sorry, I do not know which VMs offer this (does VMware do this?)....


1

If you put host-only, your VMs can access, well, only the host. Your host machine is not isolated, but the opposite: it's the only machine they can access. To isolate the VMs, you must use Internal Network. Using this network means: The host can't access the guests Guests can't access the host Guests can't access the internet Guests can access each other ...


1

You want to "secure" the computer. I do not think security is strictly an aspect of the computer and software. It matters what you do as a user on an ongoing basis. Since it is a new computer presumably the operating system is fresh. If it is not fresh install it from trusted sources. Use full disk encryption (FDE). Enabling FDE might require a re-...


1

If I wanted only internet no HDD access.. I would use Tails and run, but... You can use Tails on your computer and have a full access to your files and documents. Linux have evolved ;) But honestly, I do not think you need this much of protection for browsing the Internet on a public WiFi : Use HTTPS everywhere, have a well configured firewall and you ...


1

VirusTotal.com can be helpful to verify badness, plus, they have a free API for low volume automation. If you use a VM then be sure to isolate it per the vendor instructions. If transferring bad binaries to the VM with a thumb drive or CD then I prefer to mismatch my host and VM OS, so there is no way the host OS could even run the malware in question. VMs ...


Only top voted, non community-wiki answers of a minimum length are eligible