If you're using a virtual machine 2
you need to make sure that it is secure, 3
or in other words, it needs to be hardened. 4
We've already discussed physical isolation, 5
so let's just revisit that quickly. 6
You can have physical isolation 7
in order to give you physical hardening. 8
You could use a dedicated secure device 9
as the host for the guest VM, 10
giving you physical isolation. 11
Both the host and the guest will be hardened 12
and a separate device used for day to day use. 13
The day to day use device is more likely 14
to be attacked and get compromised. 15
The secure device, used less often and for more trusted tasks, 16
meaning the host operating system 17
and the guest operating system on the secure device, 18
are more likely to remain safe. 19
Other physical measures that you can use. 20
Using a USB network dongle instead of the host network adapter, 21
as discussed already in the area on physical isolation. 22
You can place the VM on a separate network to the host 23
or for virtual isolation via a VLAN. 24
This is to help mitigate attacks that come from the network, 25
from the virtual machines. 26
Virtual machine leaks. 27
As we've discussed, virtual machines can create 28
on the host operating system unwanted log files, 29
discaching and other evidence of the activity 30
of your virtual machine guest, 31
even if it's a live operating system like Tails or there is no virtual disk. 32
Like in this example where you see that there is no virtual disk, 33
it's difficult to know all of what is created 34
by your hypervisor on your host operating system. 35
So one approach to deal with this problem, 36
of all the unwanted host data, would be to use 37
whole disk encryption on the host machine 38
as the mitigation against these leaks. 39
If you have significant adversaries and high consequences, 40
this would always be recommended anyway, 41
and we discuss more on disk encryption 42
and file encryption in its own section and we go into quite a lot of detail. 43
So defense against leaks or one of the defenses against leaks, 44
whole disk encryption. 45
Not only can we do whole disk encryption to prevent the leaking, 46
we could even create a whole hidden operating system 47
from which we have the hypervisor installed 48
and the guest VM running. 49
This makes even finding or knowing that leaks exist difficult 50
and it also provides plausible deniability. 51
But of course this only protects you when the machine is switched off, 52
as the encryption keys are stored in memory when the machine is on. 53
Another possible mitigation against unwanted storage on the host 54
leaks from discaching is to disable or delete the caching. 55
Host operating systems usually use virtual memory called swapping 56
or paging which copies part of the RAM to the hard disk. 57
There are also modes like sleeping and hibernating. 58
It's possible to disable this functionality 59
to prevent it from being stored to disk, 60
but you should do this at your own risk 61
as it’s possible that it can cause problems with your host operating system. 62
And we do cover more on clearing the page 63
and swap in the section on evidence elimination. 64
So if that's something that interests you, check out that section. 65
Moving away from leaks now 66
and on to protecting the data within the virtual machine. 67
You can enable encryption 68
using the hypervisor for each of the individual virtual machines, 69
but obviously again this only protects them 70
when they are switched off. 71
Using the hypervisor’s encryption is probably 72
a less tried and tested solution 73
than encrypting the operating system itself 74
using more well-known encryption technology such as LUKS, 75
FileVault 2, Bitlocker, and VeraCrypt 76
which have been subject to more public and community scrutiny 77
than perhaps the hyperdriver encryption has. 78
Enabling both encryption in the hyperdriver 79
and within the operating system 80
will slow down your virtual machine, 81
but does give you defense in depth. 82
You want to reduce the attack surface of your hypervisor 83
and here are some of the features that you might consider removing. 84
You might want to disable the audio and the microphone, 85
and not specific to virtual machines, 86
you might want to cover your webcam with tape, 87
disable shared folders, 88
disable drag and drop and clipboard, 89
don't enable video acceleration, 3D acceleration, 90
and do not enable serial ports. 91
If you can, do not install VirtualBox Guest Addition 92
or VMWare Tools or equivalent. 93
That gives the operating system 94
more access to the hypervisor 95
and it gives a guest access to more of the host like the microphone 96
and increases the attack vector. 97
You want to remove the floppy drive and remove any CD or DVD drives. 98
If it's a Live operating system, 99
you want to remove any virtual disks. 100
Do not attach USB devices if you can help it, 101
perhaps the network dongle, 102
but nothing else if you can avoid it. 103
Disable the USB controller which is enabled by default. 104
When you disable the USB controller, 105
this requires you setting the pointing device to be a PS/2 mouse 106
so that your mouse will work. 107
Do not enable remote display server, 108
do not enable I/O APIC or EFI. 109
Enable PAE/NX, NX is in fact a security feature. 110
NX helps your processor guard the PC from attacks from malware. 111
And remove anything that's not used. 112
If you are concerned about someone getting a hold of your device 113
and local forensics, 114
then use non-persistent operating systems like live CDs, live USBs 115
and don't add virtual storage 116
when setting up the virtual machine. 117
You can create your own custom live operating system, 118
so you go about installing 119
whatever operating system it is that you want, 120
configuring it in the way that you want, 121
and then you can convert the virtual disk to an ISO 122
and then boot from the ISO as a live CD. 123
If you look at this thing here, 124
this talks through converting a virtual disk image to an ISO. 125
You can use VMware snapshots to create non-persistence. 126
You can use these snapshots for security 127
for evidence elimination by establishing a securely 128
updated virtual machine that has never performed 129
any other activity than what you want it to have performed 130
and then snapshot that VM. 131
So for example, here would be the clean 132
VM with no evidence and no history. 133
This is your current state where you perform your activities, 134
then after you’ve performed your activities 135
you restore 136
back to the original clean VM. 137
This'll remove any malicious malware, 138
it'll remove history, tracking, or any evidence of activity. 139
This is not a perfect solution to remove evidence 140
due to the previously discussed possibilities 141
of data leakage remaining on the host, 142
but it is a reasonably good solution for basic non-persistence. 143
There's some security issues 144
around the power saving features of your devices. 145
If you pause or suspend your device 146
when you have an encrypted virtual machine, 147
the encryption keys are stored on the hard disk. 148
This isn't safe unless you retain 149
full physical control over the device. 150
Again, in the same light, if you hibernate your laptop 151
with whole disk encryption, 152
the encryption keys are stored on the hard disk. 153
This isn't a virtual machine issue, 154
but this isn't safe either 155
unless you maintain control over the device. 156
If you put your laptop into sleep or standby, 157
any whole disk encryption keys will be stored in memory. 158
Again, this isn't safe unless you retain 159
physical control over the device. 160
If you're using encryption, either with a hypervisor 161
or with a guest operating system, 162
or with a host operating system, 163
it is best for all of the operating systems, 164
the guest and the host, 165
to be logged out and shut down and switched off, 166
fully switched off, not paused, not suspended, not hibernated. 167
This way, the decryption keys are not stored on disk anywhere.