0

QUESTION

Short Statement

How much of a protection against Windows 7's zero-day vulnerability after its 'end of life' (scheduled for January 2020) would I get if I

  • host a Windows 10 virtual machine in a Windows 7 physical machine and
  • 'confine' Internet activities to the VM?

Long Statement

If you can answer the question as above, you don't have to read what's below. I provide it for those who prefer to consider a concrete situation.

The hypothetical setup is as follows.

  1. Install to the physical machine only the following: Windows 7, all of its security updates (released by 'end of life'), device drivers (and whatever else is needed to 'run' the machine), and a version of VMware Workstation.
  2. Create a W10 VM.
  3. When I turn on the physical machine, I don't do anything with it except to turn on the VM. I only 'use' the VM. If I have to install any program I do it to the VM. If I have to use the Internet, I do it in the VM.
  4. There is no other machine in the LAN.

Of course I realize that 3 above does not exactly 'confine all internet activities' to the VM because the traffic must go through the physical machine. The more correct thing to say might be that my doodling will be confined.

An ideal answer might be in the following form.

  • Break down the zero-day vulnerability to its major components.
  • Say which of those components the setup above will be good against (i.e. as good as simply installing and using W10 on the physical machine).
  • Say which of the risk components the setup will be helpless against.

Another way to conceptualize the question would be say: Where between the following will the setup land me?

  • Full vulnerability of using W7 after 'end of life' and
  • the full protection of using W10.

I don't mean that W10 will give me 'full' protection. I just mean 100% of the protection of switching to W10, however great or small that may be.

I gave VMware Workstation, only for concreteness. If this is not the best choice, please mention what may be.

BACKGROUND

I am providing the following realistic situation for those who like to know 'where the question is coming from.' You don't have to read it if you don't need it.

I have been lazy and done nothing about the looming end of life, and now am really up against it. Unfortunately my W7 machine has got a lot of tweaking to it, and it would take a long time to replicate that in a new W10 machine (not like I have no other responsibilities in life).

As a stopgap, therefore, I want to set up a W10 VM and start doing at least the obviously 'dangerous' things there, e.g. going online, installing new software. I would continue to use the W7 for 'safe' things, e.g. playing music on software after disabling updates and otherwise doing what I could to keep it within firewall (obviously I don't mean that it's really safe) until I have managed to create a W10 system for the physical machine or decided that I would switch to Linux and keep W10 to a VM.

Realistically, there will be other machines in LAN.

Thanks very much!

4
  • Please assume that I have to host a W10 in a W7. That's what the question is about. I already got an answer recommending the other way around (W7 in a W10), I accept that it would be better, but for the purpose of this question please assume that it is impractical for me for some time. Oh yes, I am going to use W10 LTSC, if that makes a difference. Thanks.
    – user778992
    Nov 7, 2019 at 2:22
  • I read your question very carefully and understood it well. But I think you have it turned around. Windows 10 host has internet as you need, copy of Office (my assumption) and basics. So then use Windows 7 without internet until it makes sense for you to leave it behind. Windows 10 LTSC starting with V1903 or 1909 will be fine.
    – John
    Nov 7, 2019 at 2:29
  • @John. I do feel the 'love' and appreciate it. Just to 'motivate the practicality,' there is my mother's machine, for example, thousands of miles away. I could FTP over a VM and say, "Use this for now," but don't have vacation time to fly over. I will delete these comments after/if I get answers. System seems to discourage back and forth.
    – user778992
    Nov 7, 2019 at 2:50
  • Your Windows 7 machine will have to have some internet to provide for the Windows 10 machine to have Internet. Also many apps need Internet. So confining internet to a Virtual Machine does not protect the host very much at all. So the direct answer to your opening question is: not much protection against Windows 7 deficiencies. Security is getting very critical
    – John
    Nov 7, 2019 at 2:55

2 Answers 2

1

There will be an ever increasing reduction in security for Windows 7 starting January 1, 2020.

So make your Host Machine Windows 10 and your virtual machine Windows 7. I have a Windows 7 VM (using VMware Workstation) for occasional needs so security is less a concern.

Windows 10 V1903 is very secure and much desired as your host machine.

Once set up, you can tweak your Windows 10 machine over time and reduce dependence on the Windows 7 VM.

Follow up note: You can do what you are proposing. I did it myself when Windows 10 was pre-release 5 years ago. However, the host machine must be connected to the Internet, so the proposal that Windows 10 VM will protect Windows 7 host is not correct. Such protection will not happen.

0

Your risk area is VMware rather than Windows 7, and unlike Windows 7, VMware is still being updated.

The risk is called Virtual machine escape or breakout, meaning that code running on the guest will breakout of the VM to infect the host. Windows 10 in such a case may be more resilient than Windows 7, but there is no guarantee that it can resist such an ultra-sophisticated virus.

Such a breakout is extremely hard to effect.

You may find a list of all such known exploits in the Wikipedia article Virtual machine escape. Most of them are pretty old. Examining the list will show the weak spots:

  • Shared folders between host and guest
  • VMware Tools (this is not a vulnerability by itself but adds more possibilities for escape)
  • Cortado ThinPrint (old problem)

You can also read the article from the Keen Security Lab Blog: A bunch of Red Pills: VMware Escapes, for more information about such exploits.

VMware has a very good bounty program for exploits and participates in the Pwn2Own hacking contest, held annually, so its security is rather good and it is pretty safe to use.

If worried about security, I would suggest updating VMware regularly when new versions or patches come out. I see this as your best defense.

2
  • VMware needs to be patched and up to date of course. I have it running and no issues so from my point of view, Windows 7 is a growing security risk
    – John
    Nov 7, 2019 at 21:25
  • @John: Windows 7 is no danger if it does nothing except running VMware.
    – harrymc
    Nov 8, 2019 at 5:54

You must log in to answer this question.