Question

Posted

My server has anti virus, and I have a virtual machine on that too, is it recommened to install anti virus on the virtual machine aswell?

To me it seems pointless, using more resources for nothing considering the host has the anti virus.

Whats your thoughts?

Share this post


Link to post
Share on other sites

35 answers to this question

  • 0

Posted

no, it's not necessary, the VM is completely isolated from the host as long as you don't have shared folders turned on (even then it's highly unlikely that any virus would know to make use of that)

Share this post


Link to post
Share on other sites
  • 0

Posted

That very much depends on what you are using the VM for. The VM can definitely still get a virus. And the VM isn't completely isolated from the host if it's on the same network. You could easily spread the virus back to the host over that network, just like any other two computers on the same network. If it's just a temporary VM that you are going to tear down, or can afford to wipe out and replace if it does get a virus, then maybe you don't care. If it's a VM that's going to stay running and is daily use, you'll probably want to put AV on it. AV on your host has nothing to do with your VM, so treat it as if it is it's own machine.

Share this post


Link to post
Share on other sites
  • 0

Posted

^ i was talking completely isolated as in file system wise, the fact that it's still using the same network should (i at least hope) be a given
though i definitely agree with you that it also depends on how the VM is being used

Share this post


Link to post
Share on other sites
  • 0

Posted

If it's on the network; I suggest you treat it like you would any physical server/workstation on that network.
3 people like this

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='Brando212' timestamp='1351104163' post='595269445']
^ i was talking completely isolated as in file system wise, the fact that it's still using the same network should (i at least hope) be a given
though i definitely agree with you that it also depends on how the VM is being used
[/quote]

Oh, right, it won't spread from the VM's HDD to the host's HDD. But it can still propagate over the network.
1 person likes this

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='AJerman' timestamp='1351105928' post='595269499']
Oh, right, it won't spread from the VM's HDD to the host's HDD. But it can still propagate over the network.
[/quote]
Well actually, if you're using VirtualBox there's an exploit for that... ;)
1 person likes this

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='Kami-' timestamp='1351106171' post='595269517']
Well actually, if you're using VirtualBox there's an exploit for that... ;)
[/quote]

:laugh: Really? I'm really not that surprised. If the files are on the same hard drive, I suppose there's always the possibility. You could say that's what you get for using a free VM. Any issues like that on more trusted VMs?

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='AJerman' timestamp='1351106288' post='595269529']
:laugh: Really? I'm really not that surprised. If the files are on the same hard drive, I suppose there's always the possibility. You could say that's what you get for using a free VM. Any issues like that on more trusted VMs?
[/quote]

Most hypervisors are free. vmware, microsoft hyperv, for example are free.

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='Kami-' timestamp='1351106171' post='595269517']
Well actually, if you're using VirtualBox there's an exploit for that... ;)
[/quote]
From what I remember of the intel advisory that remixedcat posted, it effects hyperV, virtualbox and nearly every other VM system except vmware.

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='TheReasonIFailed' timestamp='1351104329' post='595269449']
If it's on the network; I suggest you treat it like you would any physical server/workstation on that network.
[/quote]

QFT

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='sc302' timestamp='1351110864' post='595269763']
Most hypervisors are free. vmware, microsoft hyperv, for example are free.
[/quote]
[quote name='n_K' timestamp='1351111202' post='595269777']
From what I remember of the intel advisory that remixedcat posted, it effects hyperV, virtualbox and nearly every other VM system except vmware.
[/quote]

I actually meant to say open source, not free, but either way, that exploit is obviously much more complex than I originally thought. Judging from what I read, it looks like everyone has it patched by now though.

Share this post


Link to post
Share on other sites
  • 0

Posted

Treat it like any other machine on the network. The fact that its running virtual means nothing. Its still got a tcp/ip stack and will still have security hole's so best keep it patched as well :rofl:

Share this post


Link to post
Share on other sites
  • 0

Posted

It really depends what your host's AV can do. I know at a vmware class I was at last week, they have antivirus plugins (vSphere 5.1) at the hypervisor level which scan and monitor the VMs instead of clients on each VM. Why? To prevent scan storms... you know, when all your VMs suddenly decide to run antivirus scans at the same time and murder your storage and performance... yea.

Share this post


Link to post
Share on other sites
  • 0

Posted

Simple solution, Sandbox.

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='n_K' timestamp='1351111202' post='595269777']
From what I remember of the intel advisory that remixedcat posted, it effects hyperV, virtualbox and nearly every other VM system except vmware.
[/quote]

VMWare isn't immune from host->VM viruses, however: [url="https://blogs.vmware.com/workstation/2012/08/crisis-virus-attempts-to-infect-vmware-workstation-or-player-virtual-machines-on-windows.html"]https://blogs.vmware.com/workstation/2012/08/crisis-virus-attempts-to-infect-vmware-workstation-or-player-virtual-machines-on-windows.html[/url]

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='luke_smily_face' timestamp='1351117708' post='595269939']


VMWare isn't immune from host->VM viruses, however: [url="https://blogs.vmware.com/workstation/2012/08/crisis-virus-attempts-to-infect-vmware-workstation-or-player-virtual-machines-on-windows.html"]https://blogs.vmware.com/workstation/2012/08/crisis-virus-attempts-to-infect-vmware-workstation-or-player-virtual-machines-on-windows.html[/url]
[/quote]
That is vmworkstation not vsphere.

Share this post


Link to post
Share on other sites
  • 0

Posted

Hello,

Yes. You could download a file over a connection the host OS doesn't scan (SSL) and then would be unable to scan the guest OS for malware from the host OS. It would essentially be a "black box" in terms of the host OS not being able to scan inside of it for threats.

Regards,

Aryeh Goretsky

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='sc302' timestamp='1351122002' post='595270117']
That is vmworkstation not vsphere.
[/quote]

I know - I assumed that was what he was referring to as it was not specified which version he meant. The home user is more likely to be using workstation.

Share this post


Link to post
Share on other sites
  • 0

Posted

Cool thanks guy, general consensus is too go with AV, so I will.

Thanks
1 person likes this

Share this post


Link to post
Share on other sites
  • 0

Posted

More or less proper system and network configuration, firewall, access control and safe browsing practices over antivirus cascade every day.
Antiviruses are reactive measures - a virus must already be inside the system to be detected by one. If there is such a hole, however, anything else can get in, given time.

Share this post


Link to post
Share on other sites
  • 0

Posted

Just throw MSE on it to be safe.

Share this post


Link to post
Share on other sites
  • 0

Posted

I upgraded from ESXi 5.0 to 5.1 yesterday and ironically there's an interesting section in the upgrade guide about some modular AV for guests and the host machine, not sure if you need the paid version or just free but it might do exactly as you want, http://www.vmware.com/files/pdf/products/vsphere/vmware-what-is-new-vsphere51.pdf
[size=1]

Share this post


Link to post
Share on other sites
  • 0

Posted

^ you can run endpoint shield vm on esxi - but you can not do it for free. In a nutshell the guest vms hand off the work of scanning and such to a different VM. A central point for all your vms antivirus/malware scanning.

You then only need to update 1 location for new signatures/dats - and work is done on 1 vm vs every vm having to use resources to scan, etc.

[attachment=320697:engpoint.jpg]

This is not something you would normally have available in a "home" lab sort of setup. But if you have budget, and you have enough vms then it does make sense to go this route.

But I do believe that the agent is now part of 5.1 (free) so I guess if you had a FREE dedicated VM appliance that would do the scanning you could do it for free? I would also assume you need vcenter, the few companies I looked at that supply appliances, etc. State you need vcenter - which is not free again.

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='Jone11' timestamp='1351684868' post='595286917']
Sandbox ,which protect your host from virus.A sandbox is use for separating two programs , so that one cannot affect the other. It's a form of security for when there is uncertainty of one program's effect on the other. :)
[/quote]
NO! People assume a sandbox protects them well NO! IT DOES NOT!
Sandbox traps calls and emulates functions, but if someone wants to bypass it then they can and will.
Here's one that targets sandboxie for example http://www.wilderssecurity.com/showthread.php?t=251456

It's good practise to use but do NOT assume it gives you 100% protection or any kind of protection.
1 person likes this

Share this post


Link to post
Share on other sites
  • 0

Posted

[quote name='Jone11' timestamp='1351770875' post='595289145']
Ok... I got your point.. :)
If virtual machine has no network for access to your host,your host won't get affect by any virus in your guest operating system. :)
[/quote]
What? You're thinking of trojans, viruses don't need internet/network connections to operate.
1 person likes this

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.