Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm contemplating the fact about using a virtual machine to "sandbox" servers and programs on my computer. I heard that Virtual Machines can be hacked into,; a simple google search of "virtual machine security"; millions of results appear.

I know that pretty much anything can be hacked but why would Amazon use virtual machines instead of something else if they have security issues, especially if the virtual machine can "break" out of itself and infect other machines. Sure, Windows Server 2008 comes with AVG but apparently there is an easy way to bypass that.

Is this information correct, or am I reading it incorrectly?

share|improve this question

migrated from Aug 16 '11 at 15:19

This question came from our site for power users of web applications.

closed as not constructive by mfinni, MDMarra, Chris S, SmallClanger, Holocryptic Aug 16 '11 at 15:33

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

"Sure, Windows Server 2008 comes with AVG" - Um, what? – MDMarra Aug 16 '11 at 15:24
Either post a specific vulnerability that you're concerned about, or this is likely to get closed as "not a constructive question". – mfinni Aug 16 '11 at 15:26
AVG is a company, not software. Neither the company nor any software it writes is included with any version of Windows. AVG does produce software that may be licensed (in exchange for monetary consideration, not free) for a server running Windows Server 2008. – Chris S Aug 16 '11 at 15:30
I would like this question deleted. – alexy13 Aug 16 '11 at 20:12
up vote 5 down vote accepted

1) AVG doesn't come with Windows. At first I thought this may be a reference to some form of memory protection method for scrambling where executable code is located in memory to prevent overflows from targeting specific known executable locations for gaining access to systems, as the acronym is eluding me at the moment, but Google is only showing the antivirus. AVG is a commercial product.

2) Virtual machines are as secure as a LAN of physical computers. VM's also have a huge number of advantages for redundancy and load balancing and creating and managing a large number of systems without the added overhead of power and resource consumption that physical machines use.

As for security issues, I've not read directly of anything that will "break out" of a VM and attack other VM's, at least not anything that wouldn't do the same thing with the same methods as a physical network client attacking other physical network clients.

I think that you might be jumping the gun with your conclusion and may want to delve a little deeper into what exactly the security issues are with VM's. Amazon uses VM's because they are far far far simpler to manage and dynamically create/destroy as load necessitates.

share|improve this answer

Safe compared to what? Compared to running your different environments on separate physical hardware, VMs are not as safe, but that would be fantastically expensive. Compared to running your environments as different processes in the same instance of the OS, which is the practical alternative, VMs are pretty safe.

share|improve this answer

You are correct on a bit, but, overall incorrect.

Yes virtual machines can be hacked, but so can any other type of machine.

For example, if a machine (physical or virtual) is hosting a website, and that is the only thing from the box that is open to the outside world, and there is sloppy development which has meant there is a security hole, it could be abused on either target.

The only difference I can think of with a virtual machine is that if the Hypervisor/virtualistion software contains an API that is accessible from the guest/virtual OS, it may be possible to do "funky" stuff, but, if an attacker gets this far and it was a physical machine, you have most likely already lost the box anyway.

share|improve this answer

Safe is relative.

A virtual machine is no more vulnerable to being hacked than any other from an OS-and-installed-software standpoint.

There are THEORETICAL attacks between virtual machines on the same hypervisor, but these all rely on somehow gaining access to the hypervisor layer to break VM isolation. A hack that requires you to have access to the hypervisor is not really practical and I don't know of any cases where one has been successfully demonstrated without cheating (access to the hypervisor, infecting the hypervisor, etc).

As @WilliamHlisum pointed out, by the time someone can get that level of access they've already managed to take the box. That should be your primary concern.

share|improve this answer

VMs can hack each other just like a normal computer can hack another. The VM does not have direct access to it's host however. A VM can not hack it's host in any known way outside the aforementioned. Most commonly the VMs, and rest of the public Internet, have no network access to the host machines.

Sideband attacks may be possible; but are highly unlikely (their only applicable in select circumstances to begin with) and I haven't seen any proof of concepts yet.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.