I'm looking for any information regarding how secure an encrypted Linux file system is when contained in a VirtualBox virtual drive on a Windows host? Specifically I'm looking for answers to the following questions:

  1. Does the fact it is hosted as a guest system expose the encrypted data to any new attack vectors?
  2. Aside from the threat of key loggers on the Host OS, malware etc., when the virtual machine is turned on is there the threat of a rogue host process accessing the virtual machine's file system on the fly?
  3. When both the Host and Guest OSes are turned off and the data is at rest on a storage device, is it any easier/harder to retrieve the encrypted file system?
  • any new attack vectors? -- Can you mention in brief what common vectors you're aware of so as the answerer doesn't get into redundancy about new vectors? – Firelord Mar 27 '15 at 0:46
  • 1
    Some issues in your question are discussed here and here. – Firelord Mar 27 '15 at 0:52

The guest operating system runs inside the host. The host has full control over everything that the guest does and everything that goes in or out of the guest. Thus any confidential information that becomes accessible to the guest is also accessible to the host. A rogue process on the host can access everything in the guest, assuming that it has sufficient permissions to debug the VM process.

“Hiding” confidential information in a guest slightly improves security in that stupid data-collecting malware won't notice. But it does not improve security against sophisticated attackers or even against some common malware. For example typing a password into the guest is just as risky as typing it into a host process.

On the flip side, running sensitive processes in a virtual machine doesn't worsen security (except inasmuch additional complexity is inherently bad for security). Thus the answers to your questions are 1: no; 2: yes, making your scheme useless; 3: same.

If you want to gain any security from virtualization, run untrusted software with fewer privileges than trusted software, not most. Run the potentially-malware-infected programs in a virtual machine, and your sensitive files and the encryption software on the host or in a separate virtual machine. This doesn't give you absolute security, but it does provide a significant improvement. Ideally, freeze the virtual machines containing untrusted software while manipulating sensitive data on the host or another virtual machine.

  1. When both the Host and Guest OSes are turned off and the data is at rest on a storage device, is it any easier/harder to retrieve the encrypted file system?

This scenario is similar to the security of a Truecrypt encrypted container in Host OS. If the Host is already off then accessibility can only be through personal access where more or less, the security of your data depends upon the security of your physical infrastructure, your Host OS and the security of location (another encryption) where Guest OS resides in HDD. In short, it is strictly harder to retrieve encrypted file system unless the above mentioned stages aren't secured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.