24

I have a requirement for which I have to get online without protection (firewall, anti-virus). At the same time, I don't want to risk getting infected with viruses.

If I install a virtual machine (VirtualBox) to test, and it does get infected with viruses, will it also infect my host system? In other words, can I use the virtual machine for testing without being concerned about a virus on the virtual machine infecting my host?

Improve this question
2

8 Answers 8

Reset to default
17

If I install a virtual machine (VirtualBox) to test, and it does get infected with viruses, will it also infect my host system? In other words, can I use the virtual machine for testing without being concerned about a virus on the virtual machine infecting my host?

There seems to be some misconceptions about NAT and bridge connections in VM environments. These do not allow your host to be infected. A VM operating system will have no access whatsoever to the host operating system and will be completely unaware it is operating as a Client Virtual Machine. Software running inside that operating system will be even less wise about it.

It is through direct relationships between the client and the host machine that may exist a chance of getting infected. This happens if you allow the client and the host to share folders. The largest chunk of VMware (to name one popular product) vulnerabilities of note ever found have been directly or indirectly tagged to this feature. A complete isolation is achieved by turning off shared folders. Any other vulnerability has been discovered on the Host side when vulnerabilities on the VM engine itself would allow a potential attacker to hook up through the host machine and gain access to any clients, or run code of their own.

Security issues may indeed be more involving if one is running a large VM structure such as those proposed through VMware Server topologies. But if running single-computer VMware Workstation solutions, there is no security issue under NAT or Bridge connections. You are safe as long as you don't use shared folders.

EDIT: To be clear, when I speak of NAT or Bridge connections I'm speaking only of the VM ability to share the host network connection with its clients. This does not give the client any access to the host and it remains entirely isolated, provided functionality like VM Shared Folders is turned off. Naturally, if instead the user decides to network Host and Client, then said user explicitly decided to connect both machines, and with it wave intrinsic VM security. This then becomes no different from any other private network environment and the same securities issues and concerns need to be addressed.

Improve this answer
2
  • 8
    Well, if you have the connection bridged, then the guest is the same as any other computer on your network. If you get a network-enabled worm (Confickr, Blaster, etc) then you've just introduced a malicious piece of software to your actual network. To say that the way a VM connects to a network doesn't impact the risk is a little wrong. However, your point about host access from the VM is valid.
    – MDMarra
    Commented Sep 30, 2009 at 15:49
  • Keep in mind that there's a lot more ways something can break out of a VM than just through virtualized network adapters (e.g. breaking out of VMWare with a virtual COM port device).
    – Breakthrough
    Commented Jun 21, 2015 at 4:19
4

It depends.

If your virtual machine (guest) has no network access to your host, your host won't get affect by any virus in your guest operating system.

Improve this answer
4

My 2 cents...

In a nutshell, malware that executes in the context of the guest OS will NOT be able to infect the host OS, and will likely not even be aware that there is a host OS (though, hypothetically, breaking out of the virtualized environment IS possible, it won't become very common for a while, I suspect).

Some exceptions:

  • In VirtualPC (for eg), it's possible to share a folder to the guest OS, which "sees" that folder as a drive letter.
  • Depending on your configuration, both the host and guest OS might be on the same network, meaning that a virus that exploits open ports or whatnot might be able to propagate by exploiting vulnerable system services or via network shares.
  • Last, and as it stands now, the least likely avenue, is that the virus might be VM-aware and capable of breaking out of the sandbox. Currently, this is extremely unlikely.

    • Overall, web surfing in the context of a VM is probably the safest way to surf, hands down (given the poor track record of AV s/w and other avenues of protection). In fact, using a separate, restricted account is probably sufficient, but a VM will certainly provide additional isolation.

    Improve this answer
    2

    No, if you don't setup any network connection (like NAT or Bridge) between host and guest OS. If you want to ensure total separation between the two worlds, please prefer "Bridge" connections and map one NIC to your Host PC and one other NIC to your VM-ed Guest.

    It would be like having two isolated networks sharing only the powering bus (your actual PC, indeed).

    VirtualBox, but also VMWare or Xen or Parallels, can easily setup for you such an environment

    Improve this answer
    7
    • I'm sorry, ZZambia. But your information is incorrect. I'd advise you to check it more throughly. There's no host security issue involving NAT and bridge connections under a VM environment.
      – A Dwarf
      Commented Sep 30, 2009 at 11:53
    • Not yet, there's not. It's a vulnerability, just waiting for somebody to figure out how to exploit it. Maybe. Better safe than sorry.
      – Phoshi
      Commented Sep 30, 2009 at 12:22
    • I think Zzambia uses the word "bridging" in two different contexts here. It seems to me the risk for bridging host and VM is not any different from another computer within the same network abusing vulnerabilities. (Or, maybe worse, when the networks are being bridged then the firewall that stops attacks from another computer, might not be configured to stop attacks from the VM?) Using "bridge connections" from NIC to host, and from another NIC to VM seems something different (but: might not be required?). (If I am missing the point then just say so and I'll delete this; no need to explain!)
      – Arjan
      Commented Sep 30, 2009 at 12:32
    • @Poshi, a vulnerability is by definition something that has been identified. It's of very little relevance to discuss vulnerabilities that haven't been found yet or that cannot be found. read further... @Arjan, Indeed. But a Bridge or NAT connection under a VM environment happens entirely between the host machine operating system and the VM host engine. The client machine runs independently of this Bridge and totally isolated from it. Zzambia argument is comparable to saying that you can get infected because you are connected to the internet and I just downloaded an infected file.
      – A Dwarf
      Commented Sep 30, 2009 at 12:46
    • @Zzambia, you might want to edit your answer to explain to which part of the question the "No" applies. :-) Or, of course, if A Dwarf is right --and I guess (s)he is-- then simply delete your answer... (As a side note: in my earlier comment I thought you were referring to bridging the host OS and the VM OS, not the host OS and the VM Engine. So, I thought you were talking about an additional step, after getting the VM connected to the internet, to explicitly interconnect host OS and VM OS. I now understand that's a lack in my knowledge of terminology used with VMs.)
      – Arjan
      Commented Sep 30, 2009 at 13:07
    1

    Yes, if you have shared folders...

    Either shared folders through the VM, or standard networking.

    I am not sure, and have not seen any viruses in quite a while that spread like this and edit files over a network, but it is possible.

    Just because it is a VM does not mean it is safe, you just have to treat it like another physical machine on your network.

    So, if you have anti virus on your host machine (and others on your network) you are as safe as you are going to be, but again... treat any VM like any other physical machine.

    The only safe way to run a VM is to disable networking features (or VLAN separate it completely from your network... and not have any sort of management interface on that VLAN.) and disable all the host/guest integration that involve sharing files.

    Improve this answer
    1

    Technically it is 100% possible to be sure - even if the network is isolated and are not sharing folders.

    Although it is very unlikely unless the virus developer knew of a flaw in the combination of your host OS and your Guest VM and targeted it sepcifically. If you want to make a virus you want to make one that affects the largest number of computers possible and you won't find a flaw to exploit in some rare frequently used application.

    The same answer holds for a sandbox or any layer of interpretation between the two. I think if you could run a 32 bit guest OS and a 64 bit host you would be the most safe since the exploit to target the guest OS to overflow and then also trigger the overflow in the vm/sandbox would be even more challenging since you'd have to compile the payloads in 4 combinations - but then again this is what is typically done with an attacker and a single operating system layer - the payload is prepared for the OS or exploitable service version and one for each 32 and 64 then he just throws them both at the machine.

    It is exactly like the previous comment on BSD - the more uncommon your setup is the least likely a virus will target it.

    If we all ran VM's to test out software we were suspicious of or to browse the net, the fact it's in a VM wouldn't matter anymore and to be very clear again you are open to a virus infection.

    Also, there are special hardware considerations with the newer virtualization technologies and I'm primarly talking about software virtualization in which the guest machine code is being run by software in the host so that overflowing to the software instruction pointer seems to me to be extremely challenging and a waste of time. I'm not at all sure how this changes when we deal with a bios enabled hyper V or Xen etc - it may be that the virtual machines are more isolated or it may also be worse due to a vm running it's code in the actual hardware pipeline - it really depends on how the 'bios virtualization' works.

    Improve this answer
    1

    If in VirtualBox you have no shared folders or use any of the device features and if you want to be even more sure, look at the bottom of the VirtualBox window:

    the picture, right at the bottom near the 2 computers icon switch it to not connected

    You should be able to run any viruses and not get one on the host machine, although to be sure, keep antivirus software running.

    Improve this answer
    1

    You should try Sandboxie (or any other sandboxing tool)

    enter image description here

    It will isolate your browser and delete everything after your done. That way, even if you get a virus, it won't be able to leave the sandbox.

    Benefits of the Isolated Sandbox

    • Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.
    • Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.
    • Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.
    • Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.
    Improve this answer
    5
    • 1
      the question was about "can a virus get out of this special sandbox" ... -1
      – akira
      Commented Sep 30, 2009 at 11:49
    • Uhhh I believe the benefits say: malicious software is trapped in the sandbox. If it didn't what would be the point?
      – Ivo Flipse
      Commented Sep 30, 2009 at 13:11
    • 1
      Plus no need to have an entire OS running if you only want to sandbox your browser, now is there?
      – Ivo Flipse
      Commented Sep 30, 2009 at 13:12
    • 2
      but you didnt answer the question, its just like saying "use bsd, then you dont have any viruses". the question was not "offer me sandboxing products" (vms as very big sandboxes), but "can a virus break out of a sandbox/virtual machine. and its definitively much easier to break out of such a sandboxing program (think of special prepared pictures) than of a full virtual machine.
      – akira
      Commented Sep 30, 2009 at 13:36
    • Point taken, you're probably right about the risk
      – Ivo Flipse
      Commented Sep 30, 2009 at 15:14

    You must log in to answer this question.