This section outlines the specific security mechanisms offered by VirtualBox.
One property of virtual machine monitors (VMMs) like VirtualBox is to encapsulate a guest by executing it in a protected environment, a virtual machine, running as a user process on the host operating system. The guest cannot communicate directly with the hardware or other computers but only through the VMM. The VMM provides emulated physical resources and devices to the guest which are accessed by the guest operating system to perform the required tasks. The VM settings control the resources provided to the guest, for example the amount of guest memory or the number of guest processors, (see Section 3.4, “General settings”) and the enabled features for that guest (for example remote control, certain screen settings and others).
Several aspects of a virtual machine configuration are subject to security considerations.
The default networking mode for VMs is NAT which means that the VM acts like a computer behind a router, see Section 6.3, “Network Address Translation (NAT)”. The guest is part of a private subnet belonging to this VM and the guest IP is not visible from the outside. This networking mode works without any additional setup and is sufficient for many purposes.
If bridged networking is used, the VM acts like a computer inside the same network as the host, see Section 6.5, “Bridged networking”. In this case, the guest has the same network access as the host and a firewall might be necessary to protect other computers on the subnet from a potential malicious guest as well as to protect the guest from a direct access from other computers. In some cases it is worth considering using a forwarding rule for a specific port in NAT mode instead of using bridged networking.
Some setups do not require a VM to be connected to the public network at all. Internal networking (see Section 6.6, “Internal networking”) or host-only networking (see Section 6.7, “Host-only networking”) are often sufficient to connect VMs among each other or to connect VMs only with the host but not with the public network.
When using the VirtualBox extension pack provided by Oracle for VRDP remote desktop support, you can optionally use various methods to configure RDP authentication. The "null" method is very insecure and should be avoided in a public network. See Section 7.1.5, “RDP authentication” for details.
The shared clipboard allows users to share data between the host and the guest. Enabling the clipboard in "Bidirectional" mode allows the guest to read and write the host clipboard. The "Host to guest" mode and the "Guest to host" mode limit the access to one direction. If the guest is able to access the host clipboard it can also potentially access sensitive data from the host which is shared over the clipboard.
If the guest is able to read from and/or write to the host clipboard then a remote user connecting to the guest over the network will also gain this ability, which may not be desirable. As a consequence, the shared clipboard is disabled for new machines.
If any host folder is shared with the guest then a remote user connected to the guest over the network can access these files too as the folder sharing mechanism cannot be selectively disabled for remote users.
Enabling 3D graphics via the Guest Additions exposes the host to additional security risks; see Section 4.5.1, “Hardware 3D acceleration (OpenGL and Direct3D 8/9)”.
Enabling CD/DVD passthrough allows the guest to perform advanced operations on the CD/DVD drive, see Section 5.9, “CD/DVD support”. This could induce a security risk as a guest could overwrite data on a CD/DVD medium.
Passing USB devices to the guest provides the guest full access to these devices, see Section 3.11.1, “USB settings”. For instance, in addition to reading and writing the content of the partitions of an external USB disk the guest will be also able to read and write the partition table and hardware data of that disk.
The following components of VirtualBox can use passwords for authentication:
-
When using remote iSCSI storage and the storage server requires authentication, an initiator secret can optionally be supplied with the
VBoxManage storageattachcommand. As long as no settings password is provided (command line option--settingspwfile
, this secret is stored unencrypted in the machine configuration and is therefore potentially readable on the host. See Section 5.10, “iSCSI servers” and Section 8.18, “VBoxManage storageattach”.
-
When using the VirtualBox web service to control a VirtualBox host remotely, connections to the web service are authenticated in various ways. This is described in detail in the VirtualBox Software Development Kit (SDK) reference; please see Chapter 11, VirtualBox programming interfaces.
The following features of VirtualBox can present security problems:
-
Enabling 3D graphics via the Guest Additions exposes the host to additional security risks; see Section 4.5.1, “Hardware 3D acceleration (OpenGL and Direct3D 8/9)”.
-
When teleporting a machine, the data stream through which the machine's memory contents are transferred from one host to another is not encrypted. A third party with access to the network through which the data is transferred could therefore intercept that data. An SSH tunnel could be used to secure the connection between the two hosts. But when considering teleporting a VM over an untrusted network the first question to answer is how both VMs can securely access the same virtual disk image(s) with a reasonable performance.
-
When Page Fusion (see Section 4.9.2, “Page Fusion”) is enabled, it is possible that a side-channel opens up that allows a malicious guest to determine the address space layout (i.e. where DLLs are typically loaded) of one other VM running on the same host. This information leak in it self is harmless, however the malicious guest may use it to optimize attack against that VM via unrelated attack vectors. It is recommended to only enable Page Fusion if you do not think this is a concern in your setup.
-
When using the VirtualBox web service to control a VirtualBox host remotely, connections to the web service (through which the API calls are transferred via SOAP XML) are not encrypted, but use plain HTTP by default. This is a potential security risk! For details about the web service, please see Chapter 11, VirtualBox programming interfaces.
The web services are not started by default. Please refer to Section 9.21, “Starting the VirtualBox web service automatically” to find out how to start this service and how to enable SSL/TLS support. It has to be started as a regular user and only the VMs of that user can be controlled. By default, the service binds to localhost preventing any remote connection.
-
Traffic sent over a UDP Tunnel network attachment is not encrypted. You can either encrypt it on the host network level (with IPsec), or use encrypted protocols in the guest network (such as SSH). The security properties are similar to bridged Ethernet.
-
Because of shortcomings in older Windows versions, using VirtualBox on Windows versions older than Vista with Service Pack 1 is not recommended.
The following components of VirtualBox use encryption to protect sensitive data:
-
When using the VirtualBox extension pack provided by Oracle for VRDP remote desktop support, RDP data can optionally be encrypted. See Section 7.1.6, “RDP encryption” for details. Only the Enhanced RDP Security method (RDP5.2) with TLS protocol provides a secure connection. Standard RDP Security (RDP4 and RDP5.1) is vulnerable to a man-in-the-middle attack.