Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
So I was suggested to use Tails on a VirtualBox software. But as I was going thru the documentation, I saw this security limitation
"Both the host operating system and the virtualization software are able to monitor what you are doing in Tails."
I would like to know what changes should be made to host machine(XP,Vista,Win7) and to the VirtualBox software so that the info cannot be traced.
This one irks me, especially when the "VMs are magic" crowd provide answers like:
If you are using your own computer, it is probably safe.
As the documentation states there are limitations. The "guest" (Tails) cannot do anything about the actions of the "host". It is running inside a virtualized environment that Tails expects and believes to be hardware. Some of Tails' properties only hold if it is running in the environment that it expects!
It has anti-forensic properties, Tails is meant to not leave forensic evidence on the system. If you run Tails inside of a VM on a host system that uses a pagefile or swap, chunks of the memory in use by the Tails virtual machine will be written to disk. This means information about the website your were browsing, your cryptographic keys, your plaintext instant messenging and email may just be written to disk in plaintext. Worse still if the systems support hibernation or suspend-to-disk, it will write the entire contents of memory(!!) to disk! Everything in your Tails session would be stored on the filesystem of the Host machine.
Tails cannot be amnesic anymore. The VM, too, is possibly storing unexpected information about it's state even if you've disabled paging/swap (can you even fully do this under Windows?) and hibernation.
Using full disk encryption isn't even a great solution, many Linux installers only encrypt the swap with the same master key as is used for your system partition. Ideally swap should be encrypted with a random key generated each boot. This means on shutdown the key is purged from memory and swap is, for all intents and purposes, irrecoverable. However in the current LVM-on-LUKS setups as used by Debian, Ubuntu, et al. the swap persists and your system key can be used to reveal your past activities. Infact previously "Full Disk Encryption" solutions like Bitlocker used to write to a hibernation file outside of the encrypted partition, meaning your encryption key for the disk was written in plaintext...to the disk. So everything your computer was doing at the time of hibernation (or the last time it hibernated) would be readable by anyone with physical access.
Be very careful when second guessing the design decisions of, and especially the large warning signs created by, the Tails team. They are not arbitrary decisions.
If you are using your own computer, it is probably safe. If you worry about backdoors, read the source code of linux, compile it, and use it.
