I generally do all of my web browsing in a VM. I have one \"safe\" VM running Ub
ID: 661627 • Letter: I
Question
I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here.
I also have an "unsafe" VM with Ubuntu that does not have the guest services installed.
Tonight I was using the unsafe VM to browse some less than savory areas of the internet when one of the annoying FBI popups occured. No big deal...and then I see Norton from my host machine pop up with a blocked action on C:WindowsSysWOW64 mnat.exe. The alert name was "Web Attack: Ransomlock Website 7" and it came from the fake fbi website in the popup. This may not be important...but as an FYI I was using Chrome to surf.
I don't fully understand the VMware NAT system, but does this sound like malware could have leaked from the VM onto my host, or does Norton have insight into what vmnat.exe may have been calling and sending back to the VM.
I mainly just want to make sure my host is "safe", but I am also curious as to how this works.
Explanation / Answer
Let us first tackle the VM network. An external address, usually routable, is the "outside" of the NAT. The machines behind the NAT have an "inside" address that is usually non-routable.
Bridged mode acts just like the interface you're bridging with is now a switch and the VM is plugged into a port on it. Everything acts the same as if it were another regular machine attached to that network.
If you are in a bridged mode and a malware infects it then it can read your routing table and can identify your network range to pivot into other machines. Now coming to the infection. Ransomeware is a typical malware that locks your machine upon infection. The images you saw on your screen were all fake. If you had noticed it must be asking you to pay some fine to unlock your computer. This is a trick that ransomware applies to steal money. One of the ways ransomeware reached your machine was that the website you were browsing was hacked and an invisible iframe must be injected that redirects you to a browser exploit thus dropping and executing the malware onto your system. Its a good move that you have separate vm for different browsing activities. If you keep them in a NAT network mode then the infection will only stay inside the VM. You can imagine what would have happened if ransomeware have had locked your host os .
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.