Virtual machine security?

[12 Monkeys]

Hi!

Hope this is the right section. If not, move it.

This is a newbie- and also probably a stupid, question. When I/we use virtual machines, VmWare and virtualbox etc.
How insecure are we? They "sell" it as safe. Like you can blunder around in a vmachine. You guys know
I guess, what is the bleed over between the virtual and the actual? Do we feel a false safe security?
Can they easily use the virtual to get into my working box?
Personally I use the same amount of sec stuff for my machines that I do for the rest.

Would love some insight

Mikael

[gm10]

It's never 100%, a number of VM escape vulnerabilities are getting found and fixed all the time. If you want to run risky software in a VM it's important to use the latest versions, not the ones from the repositories.

Just have a look at all the criticial security vulnerabilities fixed in Virtualbox this month: https://www.oracle.com/technetwork/secu ... pendixOVIR

[snowflake]

It depends on what you're doing in the virtual, my host crashed because of things I was doing in the virtual many times in the past, so I think there is no real 100% "safety by isolation", but yeah running a suspicious program/code in there ,is way more secure than running directly on the machine.
,

[gm10]

On topic: Vbox escape 0day published a few hours ago: https://github.com/MorteNoir1/virtualbox_e1000_0day