2

I would like to run Windows in a virtual machine on my linux box. However, there is some concern from others on the same physical network that if the Windows box is compromised then they will effectively have access to the network as if they had root on the linux host.

The reason why they think it might get compromised is that it won't always be running and hence will not have the latest security updates for some period after I start it up.

Is there some way to ensure that even if the Windows virtual machine is compromised, they have no more access to the network than a normal non-root user would on the local host machine?

  • 1
    So the simple solution is don't compromise the machine by not connecting it to the network. Just don't give the windows machine any permission on the network drives. – Ramhound Oct 10 '14 at 18:58
  • @Ramhound If you do that and it gets compromised is it true that it still wouldn't be able to get access to the network? – Lembik Oct 10 '14 at 19:32
  • If the VM isn't ever connected to the network then when compromised its not connected to the network. – Ramhound Oct 10 '14 at 19:38
  • @Ramhound I need to access the Internet to update software and the OS on the vm . – Lembik Oct 11 '14 at 7:41
4

Secure your Windows VM like a normal networked computer, even if it is "only" a VM
You should secure your Windows VM in the same way as you would secure a Windows computer that is directly attached to your network:

  • Install security updates.
  • Install a virus scanner.
  • Run backups for all non-trivial data.
  • Disable root/admin access or use strong authentication.
  • Only install services that you actually need and disable the rest.
  • Keep system logs and track them regularly for important messages.

Don't forget to put limits/quota on your VM to prevent your VM to consume all your hdd/RAM/CPU/network capacity/...

Access to your network
The type of access from the Windows VM to the network depends on your network visualization and the connectivity requirements for VM. A VM will be a sandbox if you set it up as a sandbox (for example using host-only networking). If you set it up as just another device on your network, then it will not be a sandbox, but it will be just another device on your network. If an external user obtains elevated privileges on the VM, it can so the same things on the network as if the device was directly connected to the network.

If, for example your Windows VM is setup as an internet proxy server and an internal or external user gains elevated privileges on that server, it is definitely a security threat, as internet traffic of your entire company can be seen and manipulated by that user.

In general, if there are specific and grounded risks that the Windows VM is vulnerable to attacks, put the Windows VM in a separate network segment and use firewalls and other networking security tools such as a reverse proxy to prevent further penetration.

Access from your VM to the VM host
There are (as far as I know) no real-world cases where a guest can access files on the host other than files that are "normally" accessible through the network or via shared directories. As this is one of your (or "their) concerns, this reference to a VMware document might be useful. I quote:

Virtual machines are the containers in which applications and guest operating systems run. By design, all VMware virtual machines are isolated from one another. This isolation enables multiple virtual machines to run securely while sharing hardware and ensures both their ability to access hardware and their uninterrupted performance. Even a user with system administrator privileges on a virtual machine’s guest operating system cannot breach this layer of isolation to access another virtual machine without privileges explicitly granted by the ESXi system administrator.

Although this article doesn't explicitly says so, this is (as far as I know) also true for the access from the guest to the host itself.

What to do with "them"? The "human factor"
Don't forget about the human factor in cases like yours. No matter if "they" know what they are talking about, it's important to take the expression of their concerns seriously (or you risk that their concerns are going into the informal circuit of your organisation). Get your VM expert in the same room with "them" and talk about the concerns and evaluate the risks and the severity of those risks.

  • Thanks for this. This quote is key "If an external user obtains elevated privileges on the VM, it can so the same things on the network as if the device was directly connected to the network. " This is exactly what they are worried about. So the key thing seems to be to set it up as a sandbox which I need to learn how to do. The only purpose for the Windows VM is to be able to write and test code for Windows. – Lembik Oct 10 '14 at 19:29
  • Make sure the VM can connect to the network/internet (only if needed), but the network/internet can't reach the VM. The mentioned "host-only networking" (VM ware/Virtualbox both have this modus) does just that. That might be a good starting point. – agtoever Oct 10 '14 at 19:35
  • What access does the vm have to the local host machine? Can it read my ssh private key for example? – Lembik Oct 11 '14 at 7:42
  • There are (as far as I know) no real-world cases where a guest can access files on the host other than files that are "normally" accessible through the network or via shared directories. See this IS-SE question. – agtoever Oct 11 '14 at 8:36
  • That's good news! – Lembik Oct 11 '14 at 8:37
2

"They" don't know what they're talking about.

A local administrator on a machine has no more or less access to other machines on the network than a non-admin user would. Users and/or machine accounts need to be granted access to those other machines; if that hasn't been done, then they are safe.

If you/they are really worried about it, put a firewall between your VM and the LAN.

  • Thank you. I should have asked a more general question really. What are the risks of a compromised guest VM and how do you mitigate them? I don't really want it behaving badly masquerading as me either. – Lembik Oct 10 '14 at 18:48
  • "What are the risks of a compromised guest VM and how do you mitigate them?", that is WAY too broad of a question for this site. If the guest VM is running DOS with no network stack, then (basically) none, but if it's running XP with no updates and an auto-login with no password, and open to the Internet, then its (potentially) REALLY BAD. Firewalls, network segregation, anti-malware solutions, etc. all can help mitigate risks, but it depends on the machine, the network, and the type of attack you're worried about, so there's no one answer to give. – Ƭᴇcʜιᴇ007 Oct 10 '14 at 18:53
  • I should have said it would be Windows 7. It seems I need to work out how to put a firewall between the LAN and the VM as you say that wouldn't be breachable. – Lembik Oct 10 '14 at 19:28
  • Yes, really, the risks with adding a VM to the network are the same as if you were adding another machine to your network. If that machine does get compromised it could access resources on your network. VMs do have the ability to revert to a snapshot very easily though. If you revert after every usage you should be pretty safe. – heavyd Oct 10 '14 at 21:58
  • I wonder why they think it's any less safe than any other machine connected to the network. Is it because it's a VM? Or because it's Windows? Since "they" seem to be running the network, "they" should be aware of what security measures should be put in place, like they presumably did for the "real" machines. – Ƭᴇcʜιᴇ007 Oct 10 '14 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.