laptop-based security protections

[gpolyn]

I have been evaluating Tart for use as an Apple Silicon laptop-based virtualization manager -- so far, so many things to like about it!

Now, I am exploring security aspects, for example,

1. Can VMs be encrypted at rest?
2. When transitioning from rest to run, is the VM momentarily insecure or could a process interruption leave the VM in an insecure state?
3. While in use, does the VM lock guarantee no exploitation?
4. Similarly to "2", is the VM ever insecure when transitioning back from run to rest?

(Gosh, this is probably much more than is fair to ask patient readers!)

Maybe an additional way of discussing security for Tart is to ask whether "suspendable" state on Sonoma in Tart release 2.0 settles concerns in 1-4 above?

Thanks for any comment!

GP

[fkorotkov]

Hey @gpolyn, thank you for you interest in Tart! The VMs are normally stored on your laptops' SSD which is usually already encrypted at rest if you have FileVault enabled. As for the suspendable states of VMs, these are encrypted in a way that you can only unsuspend them on the same physical machine.

Does that answer your questions? What kind of vector attack you are considering?

[Michael-Gowing-McK]

Hi. I work with @gpolyn and have been assisting with this project. One of the attack vectors we are concerned with is an attacker exfiltrating the vm files and then being able to run the vm on another computer where we would have no visibility. One thought we had was if it was possible to have the VM files (Drive.img in particular) additionally encrypted at rest possibly using a certificate from the host so that if the Drive.img file were exfiltrated it would be either impossible, or extremely difficult, to extract any usable information or to run the VM.

[fkorotkov]

You can enable FileVault inside the VM, this way disk.img will be additionally encrypted the same way as you have you local SSD encrypted on the host. But still if someone will get access to contents of the disk.img and nvram.bin they will be able to run the VM elsewhere. You can think of it as they've stole your physical laptop.

On the other hand if someone will be able to access host in order to download the VM then you'll have a bigger problem on your hands. 😅

So I guess the best thing you can have is to enable FileVault inside the VM, have user auto-login disabled and have a strong password for the VM. This way even if a third party will get access to the files they will be in the same situation if they'd had a physical laptop on hands where FileVault claims to protect your information.

[Michael-Gowing-McK]

Thank you for the quick reply. The secure password and enabling FileVault within the VM was one of our options and it sounds like that may be the best available option. Possibly combining the disabling of auto login and forcing an extremely complex and long password, which could be provided by a something like a Yubikey, could both provide security and make any brute-force attempts extremely cost and time prohibitive.

We agree, if someone steals the VM it is the same as taking a laptop, but without the indicator of the laptop being missing, it is exactly that concern which prompted these questions.