Thanks for the link.  Great read and exactly the info I needed to better understand.

Thanks for this information!   Is there a way to determine if my license is an OEM license?  I have 2 custom built systems and one off the shelf system with product keys to choose from.

Thanks, Disk2VHD looks promising. Do all the VMs support the VHD disk format?  It looks like I’m leaning towards VirtualBox.  My CPU is Intel i54250U with 8G of Ram.

So wrt #5, it is more to do with the attack surface.  Yes the Ubuntu host is the most outer defense, but if malware is installed because of a zero day bug in windows, it will be the windows virtual machine that gets attacked.  My plan was to move all internet traffic (surfing, mail, etc) to be accessed from Ubuntu and only keep the Windows 7 environment around for some specific Windows apps with internet access disabled (for example iTunes which I use for local backups, or Photoshop which while slow is usable).  In general I would disable the Windows 7 internet via virtualbox so those using the system could not be lazy, they would have to use the Ubuntu solutions.

I was able to configure a network connection between the Windows 7 Guest and the Ubuntu Host (without allowing access to the internet from Windows) to share a printer (as sharing USB devices is not possible).  So I can print from both environments.

The last question about machine state is part of my defenses.  You can both “snapshot” a running virtual machine and “image” the PC partition.  These get placed on a separate USB drive that is only powered on during a backup or recovery.  These certainly could be written to ISOs if you wanted.  Any infection can be cured simply by restoring a previous (prior to infection) snapshot or image.

I know my approach has weaknesses.  I am relying now on Ubuntu to be maintained and updated for security patches.  I also know that attacks to and from the Win 7 Guest VM are still possible, but I have eliminated some of the potential attack vectors by limiting network traffic to only be on the Ubuntu side.  Lastly with good backup/imaging procedures on both the Ubuntu host and Win 7 Guest VM I feel I have some way to manage my risk.

OscarCP wrote:

I have understood and, please, someone correct me if I am wrong, that the connection to networks, including the Internet/Web, is via the communication’s layer of the host system, in your case Ubuntu Linux, so it should be as protected as the host itself from malware, unauthorized connections to external sites and the possibility of malware infections.

There are several ways to do this in a VM.

1) You can have the VM completely disconnected from everything, of course. This means no network-based file sharing, so you’re relying on the VM product-specific file transfer methods.

2) You can have a local virtual network that isn’t on any actual hardware. Only the host and guest can be on this network, naturally. Very secure if you don’t route any other traffic into it.

3) You can have the host behave as a router to the internal virtual network – typically with NAT enabled so outside devices don’t see what’s on the inside. You can easily have firewalls on both the host AND on the guest, and guest traffic will have to pass through both…

4) You can have the guest “piggyback” as a second address on a NIC. You know, “alias” style, except the alias is the guest. Still have host do the majority of the work. Not available in all VM products.

5) You can have a dedicated NIC for the VM. Not available in all VM products, possibly requires hardware virtualization support, host doesn’t know what the guest does, don’t have to be on any same networks.

These aren’t mutually exclusive, well, except the first one…
If you do BOTH 5 and 3, you can run a locked-down OpenBSD in the VM and have that be your edge router, heh.

OscarCP wrote:

One thing explained here that I find very interesting is that, at the end of a VM session, one can save, not only the files and updates to pre-existing applications, or any new ones installed during the session, but the state of the virtualized system as well. Does this mean that, if ever, in some way, the VM version of Windows 7 actually gets infected, that unfortunate situation can be reversed by reinstalling a session saved before the infection occurred? And if so, does making an ISO back up offer extra protection?

Well usually, by default the VM state is direct to virtual disk, so you default to saving all changes on disk. As in, the entire guest disk is a single file on the host disk, and you don’t even get direct access to individual guest files.

You can force-hibernate the guest, saving guest RAM to disk as well. May need to mind the guest system clock if you do that though…

Some virtual disk file types have builtin support for incremental changes so you can save multiple sessions in a single file, depending on the VM product.

You can backup and restore the virtual disk file as a normal file, though mind that while the VM is running, the file is held open for writing by the hypervisor… well unless the guest is running off a read-only disk. (The locked-down OpenBSD VM from a previous example might be.)

OscarCP wrote:

I have understood and, please, someone correct me if I am wrong, that the connection to networks, including the Internet/Web, is via the communication’s layer of the host system, in your case Ubuntu Linux, so it should be as protected as the host itself from malware, unauthorized connections to external sites and the possibility of malware infections.

Not as protected as with Linux, but more than you would be with bare Windows.  It depends on the attack vector of the malware in question.  If the person is tricked into running a tainted .exe, the VM will be infected as easily as a physical machine… maybe.  Some malware detects if it is running on a VM and disables itself it it is, so that security researchers have a harder time getting it to do its thing and find out how it works.  The VM software I use, VirtualBox, does not attempt to hide that it is a virtualized environment… the virtual video card is called VirtualBox VGA adapter, or something like that, for my system at least.

If the malware is like some of the recent ones we’ve heard of that send requests for various protocols across the internet and hope from a reply from someone running the vulnerable version of Windows, the request hits the Linux networking stack, and if it’s a Windows vulnerability, it stops at that point.  The VM is not exposed on the net itself, a lot like being behind a NAT router, which you may also be.

OscarCP wrote:

One thing explained here that I find very interesting is that, at the end of a VM session, one can save, not only the files and updates to pre-existing applications, or any new ones installed during the session, but the state of the virtualized system as well.

You can suspend the VM, so that everything restores just as you had it, like hibernating a system natively.  In this mode, it takes only a few seconds to start the VM and start using it.  That’s a full save state, including the state of the RAM in the VM.

The other option is to shut down the VM when you’re done.  The next time, you will have to boot the VM as from a cold start, which takes longer than the suspend save state.  When it starts, the virtual hard drive will be in the same state as when you shut it down, but it would be like booting any other computer… anything in RAM that had not been saved would be lost.  Any new programs you had installed, changes you made to the configuration within the VM, etc., would be just as you left it.  There is no option to “just” save the state of your files, though you can easily accomplish that too by adding a step, described below.

Those are the same options you get when shutting down a physical PC.

Does this mean that, if ever, in some way, the VM version of Windows 7 actually gets infected, that unfortunate situation can be reversed by reinstalling a session saved before the infection occurred? And if so, does making an ISO back up offer extra protection?

You would not have to reinstall anything– when it comes time to start the VM, just choose a snapshot earlier than the one where you think you got the malware.  If you got the malware just a minute ago, you could easily roll back to the same snapshot you used to start that VM session, and the malware would be gone.

The way that I use Windows VMs (Windows guest, Linux host) is to first get Windows installed the way I want it, with all of the programs I expect to use and all of the settings I wish to have applied, then take a snapshot of that state (full snapshot, including memory state).  I call it something clever like “Win7 initial install.”

Every time I want to use the VM, I select “Win7 initial install” and have it restore the full state of the guest.  I use it for whatever I wish, then think about whether I downloaded or wrote anything I want to save.  If so, I put that on a USB stick or a network share, then shut down the VM and tick the box for “restore initial machine state” or whatever it is that it says.  That means it will throw out all I have done for that session and roll back to the same way it was when I started.  If I made a mistake and messed up the configuration, picked up malware, etc., that corrects it, possibly before I knew anything was wrong.

If I discover that there is a program I want to install and be part of the VM state, I will first do the above shutdown procedure if the VM is already in use, then restart it from the same point as before (“Win7 initial install,” in this example).  I then install whatever it is I need, reboot if necessary, which it probably is, and then take another snapshot to use from that point on.  It would be called something like “Win7 with New Program,” where New Program is the name of the new program.

I don’t use VMs very much, though, and when I do, I seldom need to save anything locally.  Depending on what you are doing in Windows, that may not be true for you, so a constant persistent machine state may be what you want.  In that case, you can simply take a snapshot each time you want to preserve that VM’s state.  Each snapshot is a point you can roll back to if you need, and you can think of it as being like a Macrium Reflect image, except that you can also have it save what is in the RAM, your open programs and what not.  Creating a new snapshot is as quick and easy as creating a new restore point in Windows, and certainly that is a lot faster than doing a full disk image.

This way offers the same protection as using Windows 7 natively and doing lots of backups.  You would have to discover the malware in order to take action, and all of the stuff it may have done from the time you got infected to the time you discovered it may be significant.

By contrast, if you roll back to the same point you started from at the end of each session, any malware is removed whether or not you knew it was there.  It will only have had the time between infection and when you shut down the VM to do its bad stuff, which in my case is generally less than an hour.  It only takes a few seconds to open a VM and be ready to go, so I just shut it down and open it again later if I need it again.

On top of that, I know that I am going to wipe the session when I am done, so I don’t save data in the VM’s virtual hard drive.  If I knew I was going to let the state persist, I would be tempted to save things there, and that means if I ever picked up malware, there would be more stuff for it to steal.  My Windows 7 VM has nothing but a few programs in it, and the version of Firefox installed into it has one saved password, itself protected by a strong master password.  Ransomware would be useless; there’s nothing of value for it to ransom.

Ok, the site randomly decided to exit the edit mode and post that message.  I’m not done just because it’s really long, WP!

Keyloggers would not have much to record, as I don’t do any browsing or typing in the VM except for that one site that requires Windows for the Java applet to work.  All it could get would be my Firefox master password, which is not used anywhere but in that VM, and if it grabs that, it would have to have the ability to use that password to unlock my password store (Firefox encrypts the password list if you use a master password).  It is not likely the malware would be written to do that, and the odds would be against it even if it was, as when I am using that site, I start the VM, go right to their site, log in with master password, log in the site, do my thing, close the VM.  There would not be any plausible way for the malware to get into the VM between the start time and me typing the master password… it’s under a minute, and the only site I go to is the one that already knows my password.

It is a barebones FF install in my VM other than the Java plugin and that one saved password.  I don’t even have the background color set to something other than white, which hurts my eyes.  It would make me nuts to try to browse with it that way, which is why it is that way.  I want it to be dead obvious I am in the VM browser, in case I somehow forget.

Botnet malware would only do anything if the bot was set to immediately spring to life and start doing something.  Botnets often lie in wait, with compromised machines giving no sign that anything is wrong, waiting for the signal to be sent by someone, at which time the bots will do what they do… DDOS, whatever.  If it’s for the purpose of spam relaying, it could begin it at once, but it would only last until the VM is shut down.

The gist of this is that even if malware does somehow get into my VM, the odds of it doing harm before it is wiped is not very high.  It’s only a tool for those rare times when I need Windows for something that WINE or Linux can’t do, and there haven’t been many.  WINE is improving at a much faster pace now than it was before, thanks in part to Valve/Steam.

Well, that has some potential for trouble if you’re running off either of the disks… but it’s quite safe if you’re running in read-only mode and are going to remove or wipe the source disk before booting off the new disk.

Most modern Linux distros by default use stored device / filesystem id instead of hardware path, after all, and dd copies those too.

Certainly I would update it the same as I would a physical machine.

As Paul T noted, it’s your choice whether you roll back or not.

If you were running my Virtualbox VM (Win 7 guest, Linux host), and you clicked the X to close the guest window, this is the dialog you would see:

The first option saves the full machine state, so you can pick up exactly where you left off next time you run the VM, like hibernating a physical PC.  The second one triggers a Windows shutdown, and the VM will close as soon as the shutdown finishes, like shutting down a physical PC.  The hard drive state will still be retained seeing this option, also like shutting down a physical PC.  You’ll have to boot a new session when using that option, but it won’t roll back.

The third option is like pulling the plug from the PC, which you would not usually do unless the PC has locked up and will not shut down normally.  Now, if you check the “Restore Current Snapshot” box before you use the third option, it will restore the VM to the same state it was in when you started it.  It remembers the last option you use, so in my use case, all I have to do is click the X to shut down the VM window, then hit “Ok,” and it will shut down in a few seconds.  It’s terrifically convenient to get to a known clean state each time if that is your wish.  If you want to save the machine state, make sure the top option is selected and hit Ok, and the next time you go to shut down the VM, it will have that as your preselected option.

Note that if you save the machine state each time you shut it down, it makes Windows 7 a more iffy proposition after it goes EOL than it would be if you rolled back each time.  You may wish to use 8.1 or even 10 in the VM if you need to have a persistent state, since it’s the rollback that makes the VM such a neat thing for security on an unsupported OS.

Sorry, I need to correct the first paragraph above, but it is now too late to edit it, from “I am particularly interested in the creation of incremental backups of my present VM OS state together with my data (files that I’ve created, or copied from elsewhere)” to “I am particularly interested in the creation of backups of my present VM OS state as well as of my current data  on it (i.e. all of my own data files, including those I’ve created recently, or copied from elsewhere).”