8 ms·

Im currently looking for a Linux distribution to run in an immutable VM on macOS. It will only be used to run a web browser. A browser is the primary way your m

• zamadatix 5y ago
  It's resource heavy to browse in a VM, particularly if you don't use a paravirtual GPU which would greatly increase attack surface, and highly inconvenient to have your browser cleared all the time. It's not unheard of though, Windows even has a built in functionality for this for high security enterprise users.
  • thenickdude 5y ago
    If you use a PCIe-passthrough GPU instead then the paravirtual security hole gets closed by the IOMMU.
    • 2OEH8eoCRo0 5y ago
      I was trying to do this today except I only have a single GPU so it's tricky.
      • walterbell 5y ago
        If your primary OS supports a serial console, it's a bit easier.
        • saagarjha 5y ago
          Ok, but then you have to use a serial console to interact with the VM…
          • walterbell 5y ago
            The VM gets the passed-through GPU. The serial console is for setup/config of the host.
            • saagarjha 5y ago
              Ah, I see. Yeah, that works I guess.
              • neurostimulant 5y ago
                Or if your host uses an intel cpu, just use the integrated gpu for the host so the discrete gpu is free for the guest os.
• red_phone 5y ago
  There is a built-in feature, known as Application Guard, on Windows 10/11 that gives you exactly this out of the box, with minimal configuration. Biggest downside is that it only works with Edge.
  • walterbell 5y ago
    Does MS App Guard Edge isolate each browser tab and HTTP connection in a separate copy-on-write VM, like HP/Bromium SureClick?
  • cglong 5y ago
    There's also Windows Sandbox right? An ephemeral VM that gets deleted as soon as it's closed.
    • my123 5y ago
      But you can only have one Windows Sandbox running at once...
      • easton 5y ago
        This seems to be an artifical limitation in Windows Sandbox, as WSL2 and Edge Application Guard both use separate VMs and you can run them all at once. "Krypton" is the name of the isolated microVMs in Hyper-V, but they don't really document it at all.
• tyingq 5y ago
  >I’m curious why this isn’t a more popular setup? I do a fair amount of upload/download of docs and images. And some of the "cookie pre-fills stuff for me" is useful. I know you can work around all that, but I'm lazy. I suspect more lazy people like me is the primary reason it's not popular.
  • walterbell 5y ago
    Your browser profile can be placed on persistent storage, while the OS storage is reverted to known-good snapshot on restart.
• yumiris 5y ago
  If using a Linux VM, your hypervisor's checkpoint capabilities should suffice. If you want to go a step further (albeit with the caveat of using Windows), then Deep Freeze by Faronics will revert your Windows VM during each boot.
• doublepg23 5y ago
  Evergreen Theo quote: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582 Take it with a grain of salt though as they ship their own VM now too :) https://www.openbsd.org/faq/faq16.html https://www.openbsd.org/faq/faq16.html
  • viraptor 5y ago
    That's a weird opinion just like all extreme opinions. It's not meant to be perfect - it's a layer of security that mitigates some issues and hopefully exposes as few new ones as possible. Virtualisation kills almost all local IPC / filesystem / shared memory possibilities of privilege escalation through other services. It even mitigates most kernel level exploits, because after that you'll still need to break out of the VM itself. TLDR: P(non-root-vm-breakout-not-requiring-app-breakout) < P(app-breakout) and P(non-root-vm-breakout) < P(local-pe | system-service-exploit)
  • EugeneOZ 5y ago
    Huh, Linus Torvalds is an angel in comparison to this person.
• heystefan 5y ago
  You might want to check out mightyapp, I think they sell something like this.
  • walterbell 5y ago
    MightyApp is a "VDI cloud streaming remote browser" where every keystroke is sent to MightyApp servers. At least they run their own servers, instead of using a public cloud provider.
• alberth 5y ago
  It’s not linux but nanobsd is exactly what you want. It’s literally architected to be immutable. https://docs.freebsd.org/en/articles/nanobsd/ https://docs.freebsd.org/en/articles/nanobsd/
• Art9681 5y ago
  The simple solution is to provision a VM with your browser of choice and take a snapshot of it. Every time you use it, restore to the "vanilla" snapshot to revert its state.
• stepanhruda 5y ago
  Why is a browser the primary way a machine gets compromised?
  • walterbell 5y ago
    Because most public web sites, especially with ads, execute untrusted code on your local device, requiring firmware, OS, browser security sandbox and web-page access control contortions for constantly-attacked web browser engines. e.g. the most recent iOS 15.3.1 security update for iPhone 6S and later devices, https://support.apple.com/en-us/HT213093 https://support.apple.com/en-us/HT213093 > WebKit: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
• lostlogin 5y ago
  Possibly a naive question - isn’t this a complete pain? Downloads are a primary usage in the browse for me, and copy/paste is too. Do you not find that this and the ‘control v’ versus ‘command v’ thing drives you mad? How do these (relatively minor) things get solved? Key remapping might do the latter.
  • walterbell 5y ago
    Compromised machines are an even bigger pain. Downloads -> writable storage, e.g. network directory or local mutable disk. Same can be down for the browser profile directory, if that doesn't weaken your local security goals.
    • djrogers 5y ago
      > Compromised machines are an even bigger pain. And one that most people never deal with? At least from a browser exploit…
      • walterbell 5y ago
        Hundreds of millions of people are installing the most recent iOS 15.3.1 security update with one fix, https://support.apple.com/en-us/HT213093 https://support.apple.com/en-us/HT213093 > WebKit: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
        • saagarjha 5y ago
          Sure, but the update doesn't install a VM on their iPhone.
          • walterbell 5y ago
            Yes, which is why iPhones/iPads get compromised. Apple's update process may be able to restore some integrity to the system. IF the attacker gained persistent access, your only recourse is to wipe the phone and start over.
• samuell 5y ago
  Qubes OS does this with it's disposable VMs. Qubes is super cool. It's just a pity that it also imposes a bit too many constraints (especially related to USB keyboard... For security reasons) and performance penalties to make it a realistic alternative for me
• aseipp 5y ago
  Security theatre. If your browser is attacked by an 0day of any sort, or malware or whatever, it will have access to the shared credentials and information inside your browser. This means any and all cookies, shared logins, account access, tab information — is all game. That's where all the actual value is; why would I care if it's inside a VM or not when I can get credentials to your mail provider from the browser itself and just exfiltrate? It doesn't matter if you restart the browser once or a million times; anytime it has sensitive information, it is a target. Unless you plan to literally restart/wipe after every interaction with every domain in a separate same-origin policy where any sensitive information exposure occurs. But if you're that careful, what is the VM really doing for you, and why the hell are you even exposing yourself that much? Just use Lynx or something. The real solution is this: Install Firefox, install noscript to nuke all javascript, install ublock too, and get a password manager. Selectively allow any webpage interactivity, as necessary. The world isn't a Tom Clancy novel so you don't actually need to do anything more than this to be very secure and on top of almost all active threats. Ultimately to achieve what we all actually want (strong isolation guarantees that would prevent a full browser exploit from both A) your SSH keys from getting stolen and B) also your gmail spool from being attacked, and let's be honest, B is the worst case scenario) requires a rethinking of the fundamental software stack from OS to user-visible applications. No amount of Browsers-in-a-VM are a substitute.
  • 0000011111 5y ago
    I just use a 2 factor authentication app.
    • aseipp 5y ago
      That doesn't protect any active sessions; if you assume the attacker is capable of exploiting the browser, then they can just exfiltrate an active session for the user for any domain and bypass the login mechanism entirely. Done. This "reset state" approach can only protect against that if you completely wipe after every sensitive interaction on every unique same-origin policy, but at that point you're just doing all the hard work yourself. Obviously I'm not saying 2FA isn't good, and doesn't mitigate some clearly related attacks like raw credential theft (whether or not the browser is exploited, obviously.) My position is just that browsers-in-VMs is a mostly roundabout threat model whose actual benefits (such as some semblance of filesystem isolation) can be achieved other ways. The things these approaches can not fix are otherwise systematic issues that require major redesigns to achieve.
• brian_herman 5y ago
  Yeah, qubes os basically does something like this. https://www.qubes-os.org/ https://www.qubes-os.org/
• ulzeraj 5y ago
  Speaking of sandbox is there a way on MacOS to contain corpocrap(TM) that insists on running installation wizards that require admin privileges on 2022? My employer requires a certain unpopular remote access client suite that installs unnecessary background services running as root. The reliance on a certain unstable audio streaming plugin for skype calls makes everything harder to work on a VM.
• mindslight 5y ago
  I do this, kvm/libvirt on Linux, Linux browsers, SPICE/virt-viewer. I don't rollback the VMs like you're suggesting, although that does seem like a good idea to start doing. In addition to the VM-based isolation, the VMs are running on a completely separate machine. One of the other major features this gets me is that my router sends traffic different places depending on what VM it's coming from. Casual web browsing goes out a rotating cloud IP (need to move this to EU sometime), bank and other surveillance based authentication sites go out my uplink directly (fuckers), torrent traffic goes out a commercial VPN, embedded device configuration gets no WAN. Performance is acceptable, even for videos and the like. I'm sure it's considerably slower, but it works for me. I also see adding a bit of a speed bump that mentally distances the web from my main computing environment as a benefit.