There’s no doubt that computer viruses are fascinating. Whether you’re looking to use a virtual machine to visit that one risky website or to do full-blown malware analysis, it’s hard not to wonder whether using a virtual machine is protecting your computer from viruses.

While it isn’t common, there are ways for viruses to escape from virtual machines. It can spread across if the VM is connected to your home network. Many viruses can also use vulnerabilities like x86 virtualization and the virtual COM ports.

How a Virus Might Escape a VM and Infect the Host Operating System

Viruses can escape a virtual machine by exploiting features connecting it to the host machine or other environments, such as a shared home network or clipboard features.

Viruses Can Spread Across the Network

The most common vulnerability that viruses use to escape virtual machines is spreading across the network.

Many viruses are already made to spread across networks, so if you have your virtual machine connected to your router, they won’t have any trouble spreading.

How To Prevent VM Virus From Spreading Across the Network

Make sure that your virtual machine is completely disconnected from the Internet. If the virtual machine has previously connected to networks, you should make sure to have the VM ‘forget’ them.
Disable or turn off sharing for all of your serial and USB ports. You can disable access to USB and serial ports by navigating to the settings of your virtual machine and disabling the USB and serial controllers. Most applications also offer settings to disable USB and serial port access.
Disable file and printer sharing on your host machine. Certain viruses are known to exploit the file and printer sharing network feature. You can disable file and printer sharing on Windows computers by navigating to Settings > Control Panel > Network and Internet > View network status and tasks > Change advanced sharing settings > Turn off file and printer sharing.
If you need to connect to the internet, use a wireless hotspot. If you connect your virtual machine to your usual home network, you’re exposing all of your other devices to viruses. By tethering your virtual machine to a hotspot, you can turn off the hotspot and eliminate internet access at any time.

Viruses Can Spread Across Shared File Systems

Another way that viruses can spread between virtual machines and their hosts is when files are shared. If you move files from your virtual machine to your host, viruses may be able to travel along without you noticing.

Features that employ file sharing, like a shared clipboard, can also spread viruses between your virtual machine and the host.

How To Prevent VM Virus From Spreading Across Shared File Systems

Disable folder sharing. You shouldn’t have any shared files if you want to keep your host safe from viruses. A great way to start is by disabling folder sharing. Most virtual machine software supports this. You can disable folder sharing in VMware by going to VM > Settings > Options > Shared Folders and turning the feature off.
Disable drag-and-drop. Since the drag-and-drop feature connects the virtual machine to the host machine, it is an area that hackers could potentially exploit. You can disable drag-and-drop in VMware by navigating to VM > Settings > Options > Guest Isolation and turning the drag-and-drop feature off.
Disable shared clipboard. While the shared clipboard feature is enabled by default in most virtual machine applications, it’s easy to disable. You can disable shared clipboard by navigating to VM > Settings > Options > Guest Isolation and turning off the ‘enable copy and paste’ feature.

Is it Easy for a Virus to Escape a Virtual Machine?

Generally speaking, it’s very difficult for viruses to escape from a virtual machine. Most VM vulnerabilities are exploited to infiltrate valuable targets like government offices or hospitals. Since it’s so difficult, you’re unlikely to be a target, but staying safe is essential.

The reason why it’s so difficult for viruses to escape from virtual machines because the software has become extremely sophisticated. While older versions of VirtualBox and other software have known vulnerabilities, the recent releases of these programs are generally understood to be extremely secure.

Even when viruses can understand they’re inside a virtual machine, they’re unlikely to attempt to escape. Most viruses that can detect virtual machines self-destruct upon detection to prevent malware experts from analyzing them. Since legitimate exploits are hard to find, they’re generally reserved for high-profile attacks.

Most vulnerabilities hackers use to exploit virtual machines take advantage of the connection between the virtual machine and the host computer. For example, if the virtual machine is connected to your real home network, many viruses will opt to use the home network to spread. Other viruses have used avenues like cache side-channel attacks to access information about the host OS.

What Happens When a Virus Escapes From a Virtual Machine?

Unfortunately, if a virus can escape from a virtual machine, it can quickly cause serious harm to your computer. Aside from the risk of sensitive data like your financial information or passwords being stolen, viruses can damage your computer’s operating system and hardware.

There are a lot of ways that viruses have been known to escape from virtual machines and cause damage. When installed directly over the operating system, a virtual machine opens many attack surfaces, including network access, guest additions, shared filesystems, peripherals access, shared copy/paste buffers, and unified desktop features.

It’s possible to mitigate the potential damages by securely setting up your virtual machine. Ideally, the virtual machine should be isolated from your home network and any devices you regularly use. You can even run the virtual machine on a bootable USB drive on a burner computer to ensure it has almost zero access to anything valuable.

Ultimately, it doesn’t take a strong virus to cause hundreds or thousands of dollars of damage. You can save significant money and grief by taking the right precautions to configure your virtual machine.

How To Make a Secure Malware Analysis VM

While it’s impossible to completely prevent viruses from infecting your computer or network, especially when you allow them to infect a virtual machine, there are ways to reduce the likelihood of them spreading. Despite the clear occupational risk, malware analysis experts regularly allow malware to infect their virtual machines with little to no consequence.

1. Configure the Basic Specifications of Your Virtual Machine

To start, you’ll need to pick a hypervisor (also known as virtual machine software) to run your virtual machine on. VMware Workstation Pro, KVM, and VirtualBox are the best software for general use. VirtualBox is particularly good for beginners since it’s free to use while still offering the same essential features (like snapshots).

Once you’ve chosen your hypervisor, you’ll need to decide on the specifications of your new virtual machine. If possible, you can stick to the recommended amount of RAM but should consider using more than one CPU core. If you’re using only a portion of your CPU cores, you can set the execution cap to 100%, but if you’re using all of your CPU cores, you should set it lower to avoid freezing your computer.

If you need to access the Internet, you should set your networking settings to “NAT”. This is the best option since it insulates the other devices on your host network from your virtual machine while still providing the same Internet access.

You don’t need to adjust any other features unless you have a specific reason to do so.

2. Install Your Windows Virtual Machine

Once you’ve configured the basic specifications of your virtual machine, you’ll need to start working on the installation of the operating system. While you’ll need to purchase a valid software key, you can find all the available Windows versions here.

Once you’ve downloaded the Windows ISO of your choice, you can add it to the virtual machine by navigating to Settings > Storage and finding the ‘Empty’ storage device.

Click ‘Empty’ to view its attributes, then click on the CD icon next to the Optical Drive selector to open File Explorer.

Once File Explorer has opened, you can find your ISO and select it. Click ‘OK’ to confirm the selection.

Next, you’ll need to boot the virtual machine. As it boots the Windows ISO, you must answer basic setup prompts.

Make sure that you don’t activate Windows since many viruses are capable of stealing product keys. Don’t install Guest Additions, either, since many viruses can use this as an attack point.

3. Prepare Your Windows Virtual Machine for Malware Analysis

When Windows is finished installing, you’ll still need to take a few extra steps before your virtual machine is ready for malware analysis. You should start by taking a snapshot of the virtual machine since this will give you a point to revert to if anything goes wrong. You can take a snapshot by navigating to Machine > Take Snapshot.

Next, you should ensure that your host machine and any other devices on the network are adequately protected from any potential viruses. You should verify that every device has an antivirus program installed. The antivirus program should be completely up-to-date. Ensure that features like your computer’s firewall and active malware scanning are enabled.

Finally, you’ll need to install any of the software you want to use with your malware — and to find the malware itself!

It’s important to note that you should always maintain good cybersecurity practices when you’re using your virtual machine. Even if you took care to install your virtual machine correctly, it only takes one absentminded mistake to give viruses a vector to spread.

4. Maintain Best Practices To Defend Your Host Machine From Malware

To prevent viruses from escaping from your virtual machine, you must ensure you’re always safely using your virtual machine.

Here are some best practices to defend your host and reduce the likelihood of viruses escaping from your virtual machine.

Avoid plugging USB devices into it. If possible, you should disable the USB and serial port features entirely. As mentioned before, one of the most common ways that viruses can escape from virtual machines onto the host is through shared files — and USB devices represent a direct avenue to spread.
Never run viruses on it while connected to the Internet. It’s not just viruses infecting your host you have to worry about when you’re working with them on a virtual system. If they run from your network, your virtual machine can be used as the host for serious digital crimes.
Avoid putting any secure files. Anything on your virtual machine is easy for hackers to access. If you plan to work with viruses on a virtual machine, you should avoid logging into your bank account or saving any private documents.
Don’t use features like shared folders, shared drag-and-drop, or shared clipboard. These features link the host to the virtual machine and create potential attack surfaces that viruses can use to spread.
If you want to run a VPN, run it on your host. If you run it inside the virtual machine, it’s incredibly easy for hackers to bypass. They won’t have the same ability to interfere with your VPN when you run it from the host.