up vote 1 down vote favorite
share [g+] share [fb]

I am running Windows 7 as a host system and Ubuntu is running as a guest inside VMware. I can't change to another host OS.

I was wondering if it makes any sense to mount a Truecrypt container inside the guest system rather than directly on the host. I could disable the network adapter in the guest system and move files into the virtual machine via a shared folder. I assume the system is not compromised at the time, I am doing that.

I like to think, that even though my host system gets compromised by a random attack from the internet, my data are still safer inside the virtual machine, as the truecrypt container is not mounted on the host system and malware would not understand what is going on inside the VMs RAM. Is that naive?

What do you think of the approach?

Cheers, Sebastian

link|improve this question
1  
Normally, when VMs are used for securing a system, they are used in such a way that any "risky" behavior is done from the guest, not the host. A compromised guest is even less likely to infect a host than an compromised host is to get a guest. Rule of thumb: if the user is able to get at the data in the VM, malware can too, though it'd have to be pretty darn smart to figure out how to get at it. – Matt Leidholm Jun 12 '11 at 16:02
feedback

3 Answers

up vote 1 down vote accepted

That is correct. The VM is another abstraction layer. Not having mounted TC in your host system, potential attackers will not have it as easy to find.

Only if it reads through the VM, maybe if the VM saves it in RAM anyway and the RAM is scanned (if the VM-memory is of a simple type in the host OS and truecrypt has something your that you could scan for in the memory) or the VM provides a simple interface the attacker knows about.

When you’re asking for the sense of it though, in the end it is your decision. Is it that important to add that extra layer of security? Performance will decrease. And as long as your system itself is rather safe/ok, there shouldn’t be a problem.

link|improve this answer
1  
Thanks for your answer, Kissaki! So it comes back to the question whether my host system is safe which was why I thought about the VM in the first place. I guess I am approaching the question from a wrong angle and need to think more about how to secure the host system. – Sebastian Jun 12 '11 at 13:00
feedback
up vote 1 down vote

I consent to the rule-of-thumb that a VM (and any containers therein) cannot be safer that the host. Because if a malware installed a keyboard logger on the host, it will see all your passwords to access the VM (and all the containers therein).

link|improve this answer
feedback
up vote 0 down vote

You'd also be adding another layer of complexity in accessing or recovering your data. If your host is compromised such that you need to re-install your host OS or worse, replace your HDD, will you be able recover your VHDD in order to recover your container? The VHDD presents a larger surface to, for instance, a progressive real hard disk failure. The very much larger VHDD would have to remain substantially intact for you to recover the container within it.

link|improve this answer
I am planning to backup properly. So I hope not to run into the problems you describe, but I can see your point. I would have to backup the whole VM every time, I changed anything substantial inside it. – Sebastian Jun 12 '11 at 13:22
Actually I think there is something I can do about that. I could create the TC container from within the guest, but on the host outside the VHDD via a shared folder. – Sebastian Jun 13 '11 at 13:13
But what advantage does that have over creating it in the host (which I think is perfectly acceptable solution, BTW)? The container is on the host in either case. Making sure your container is well encrypted, and frequently backed up are your best defenses. – JRobert Jun 13 '11 at 16:08
@JRobert, I want to be protected from intruders, who come via the internet. I hope, that it would be more difficult for malware to access the data on a mounted container, if it is only visible to the guest. A malware on the host would not be able to access the filesystem inside the container, even though the container is mounted. As I do not plan on a network connection for the guest, it should be more difficult for malware to get inside the guest and access a mounted TC container. I think your suggestion works well in case of theft, when the TC container is unmounted. Did I miss your point? – Sebastian Jun 13 '11 at 23:32
@Sebastian, I'm not sure. I see your point about the 'mount' being on the guest and less accessible. I was addressing the container itself, which, kept on the host, would be equally available to host attacks no matter which OS was accessing it; and that strong encryption and good back-ups minimized the risk improper access or of damage. – JRobert Jun 14 '11 at 0:53
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.