2

E.g. I install Ubuntu as my main system without anything else but VirtualBox and maybe some programs that need to be installed to run VirtualBox.

Then I install within VirtualBox Windows 7 (because I need to run a custom program from my comapny that is exclusively for Win) and maybe another Ubuntu or some other Linux distro for my daily stuff (browsing the web, testing some "untrusted" linux apps, downloading stuff via torrents etc.).

The question is, am I safe when I run apps/browser within my VirtualBox or do some viruses/malware/spyware exist that can access my main Ubuntu system from Windows 7 or the other linux distro that runs inside VirtualBox?

|improve this question
  • 1
    Just a pointer, there's also Qubes OS. – sr_ Jun 4 '13 at 20:39
  • @sr_ Thanks, I will definitely check it later, but for now I am a beginner in Linux world and using Ubuntu with VirtualBox for my Win apps seems to be pretty much everything I can do with this OS ;) – Derfder Jun 4 '13 at 21:09
2

It depends on what you mean by "safe."

VirtualBox is a way to abstract the hardware through full virtualization (it is a type 2 hypervisor: https://en.wikipedia.org/wiki/Hypervisor). So it does provide you a degree of protection from any virus running in the guest OS. The extent to which you are safe is likely how paranoid you may be, but your host operating system is likely to be unaffected by any virus you may catch in the guest.

In short, you're pretty safe.

|improve this answer
  • Thanks. Btw. can you think about some case, how my host OS could be infected via guest OS? – Derfder Jun 4 '13 at 21:07
  • An easy case would be a shared folder between your guest OS and your host for example. – lgeorget Jun 4 '13 at 21:13
  • Yes, it is possible that you download something from the guest into a shared folder on the host. But that is unlikely to happen since the default download folder is almost alway called something different that the shared folder. In addition, you have to add the shared folder as a user, so the user will likely be careful about downloading anything there. – jeremiah Jun 4 '13 at 21:19
  • As for a use case, I find it hard to think of one. The person writing the exploit would have to guess at your host OS. But all they would have to go on is your virtual machine's OS fingerprint. How would they write a virus or exploit that could target your host? – jeremiah Jun 4 '13 at 21:20
  • 4
    Exploits against VirtualBox do exist. Virtualization requires the installation in the host OS of a driver. If a vulnerability exists in that driver that allows the execution of arbitrary code, an attacker could potentially take control of the host OS. As an example: coresecurity.com/content/…. – lgeorget Jun 4 '13 at 21:52
0

There is nothing preventing a "non-free" virtualised environment from sending snapshots of your screens to another machine to spy on you. In other words, if you are not running open source virtualised software, you will never know if what you are doing in your VM is being sent to a third party.

Don't believe me? Run Tails in virtualbox. Tails will warn you of this very security concern.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.