-4

I am considering to move my firewall inside Hyper-V. There will be only one Guest OS that is connected to the virtual Switch, and the guest OS is the Firewall OS. While the second adapter at the firewall OS will be connected to internal network Virtual Switch.

But I am concerned with the security, especially because this interface is facing public network.

So, is there any way, a way to access the host operating system, if I don't share the network adapter to management operating system?

And by any way, I mean, whatever it takes remotely. Legally or illegally, official or not, by any trick, hacking the host. And how big is the chance of Hyper-V having this vulnerability?

prd
  • 608
  • 1
  • 11
  • 22
  • Of course "VM escape" vulnerabilities are a thing, and they are not limited to breaking out of the emulated LAN. Anywhere there is communication between host and guest (disk I/O, video terminal, USB forwarding, RAM balloon allocation, etc etc) carries the potential for breaking out of vm jail if not properly secured. – Ben Voigt Mar 23 '23 at 16:32
  • @BenVoigt Agree.. So, there is a chance of people getting into the host bypassing the firewall VM. I've tried with ESXi before, and it was safe until it was dissolved. This Hyper-V will only run for a few months for a project, then will also dissolved. I was reluctant to buy a hardware firewall because it will be discarded. I know that ESXi has their own drivers, but Hyper-V will rely on thrid party drivers, and I can't say anything about Windows itself. I am not that familiar with Windows security. – prd Mar 24 '23 at 05:44

1 Answers1

2

And by any way, I mean, whatever it takes remotely. Legally or illegally, official or not, by any trick, hacking the host.

That would be a security vulnerability. There may very well be one, for instance a vulnerability in the NIC driver for Windows.

But you won't learn about it here. If anyone has such a vulnerability stashed away three things can happen:

  1. They tell Microsoft or vendor about it, and it gets patched. After patching, it becomes known.
  2. It can be used in an attack in the wild.
  3. It can be silently hoarded and used in a high-profile attack against a specific target, in the hope that it won't get publicly known.

So as always: define what risks you're willing to take, and think about what you're willing to spend to avoid them. Physical hardware for firewall mitigates this risk, but may open other risks (Intel ME?) and reduces flexibility. Is it worth the added cost?

vidarlo
  • 6,654
  • 2
  • 18
  • 31
  • How big is the chance of HyperV having this vulnerability? Yes... I am also considering a physical one, and yes. I am still weighing my options. Because I thought, for a small server, putting a pfSense inside would make it simpler. But I don't know how big the chance to hack into an unshared network card is. – prd Mar 23 '23 at 02:32
  • I would guess the risk is somewhat large - but the chance of discovery rather low and the consequence rather low, unless you're a high profile target. But that's *guessing*. – vidarlo Mar 23 '23 at 06:29
  • Thank you. I've made my decision. It's a lab server, and will be dissolved within a few months. It won't be listed on any DNS, and only about 30 people know it's existence. Therefore I am rather reluctant to spend more money into dedicated firewall since they are not cheap, and will be discarded. But on the other hand, I obviously don't want unwanted people to break into my system. – prd Mar 23 '23 at 11:04