3

If you set up a virtual machine with Windows 7 running, on a Windows 10 host, and do not connect the VM to the Internet, is there still a security risk?

More specifically, if I have 2 networks controllers, one is connected to Internet on Windows 10, the other is connected to a local machine not connected to internet, would that be a security issue?

I didn't find anything answer relevant to my question so far (I know though that a Windows 7 VM connected to the Internet is still dangerous)

3
  • Keep in mind that if you have Anti Virus on the Windows 7 computer and observe good browsing habits (do not go to dodgy sites) then the Windows 7 machine can still be used from time to time.
    – John
    Jan 27, 2020 at 12:00
  • If you wanted to then you can run Windows 95 in a VM. There's nothing inherently unsafe about running old versions of an OS, it's a matter of how you use it. The main security risk of your VM would be if you start executing unknown commands in the command line because a website told you to while using your Windows 10 machine.
    – MonkeyZeus
    Jan 27, 2020 at 18:51
  • You can take a snapshot of the Win7 guest and then always start it from the snapshot, effectively wiping out any changes that occurred the last time the VM ran. If you were to get an infection, it wouldn't be present in the snapshot, so power off, restart and back to clean state.
    – studog
    Jan 27, 2020 at 20:58

2 Answers 2

4

Windows 7 itself is not a security issue as long as you are not doing anything much with it.

But the moment you install on it an insecure software, or connect it via the network to an insecure computer, it becomes a security issue, as its built-in protections are pretty weak and have many known (and exploited) issues. Once infected, it can infect other connected computers of any Windows version, serving as an entry-point into the local network.

So the answer is: Using Windows 7 is secure if it connects only to a secure local network, where none of the computers is open to the internet, and if its installed software is guaranteed to be secure. It all depends on what you or your colleagues are doing.

2

As the Windows 7 VM has no contact with the Internet or any plugged devices, it's not a security issue. To access to this VM, the attacker would require a first access on your Windows 10 machine. In that case you've already been hacked :)

1
  • 1
    One could imagine that Windows 7 is vulnerable to certain "offline" attacks, e.g. autorun on flash drives exposed to the VM, to which the Windows 10 host OS is not vulnerable.
    – ComFreek
    Jan 27, 2020 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .