Hacker News Reader

dave2000

Sure, in theory. Are there any current exploits for VirtualBox?

The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

View on HN

Unsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox:

* http://arstechnica.com/security/2015/05/extremely-serious-vi...

* http://www.securityfocus.com/archive/1/495095

* https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv...

* http://www.coresecurity.com/content/virtualbox-privilege-esc...

"Requires a 0-day" is still a huge barrier. It's not 100% secure, sure, but it's an improvement.

Yeah, not arguing that. Just don't treat it like a panacea

Yes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.

Reply on news.ycombinator.com