3

So I was suggested to use Tails on a VirtualBox software. But as I was going thru the documentation, I saw this security limitation

"Both the host operating system and the virtualization software are able to monitor what you are doing in Tails."

I would like to know what changes should be made to host machine(XP,Vista,Win7) and to the VirtualBox software so that the info cannot be traced.

Improve this question

2 Answers 2

Reset to default
2

This one irks me, especially when the "VMs are magic" crowd provide answers like:

If you are using your own computer, it is probably safe.

As the documentation states there are limitations. The "guest" (Tails) cannot do anything about the actions of the "host". It is running inside a virtualized environment that Tails expects and believes to be hardware. Some of Tails' properties only hold if it is running in the environment that it expects!

It has anti-forensic properties, Tails is meant to not leave forensic evidence on the system. If you run Tails inside of a VM on a host system that uses a pagefile or swap, chunks of the memory in use by the Tails virtual machine will be written to disk. This means information about the website your were browsing, your cryptographic keys, your plaintext instant messenging and email may just be written to disk in plaintext. Worse still if the systems support hibernation or suspend-to-disk, it will write the entire contents of memory(!!) to disk! Everything in your Tails session would be stored on the filesystem of the Host machine.

Tails cannot be amnesic anymore. The VM, too, is possibly storing unexpected information about it's state even if you've disabled paging/swap (can you even fully do this under Windows?) and hibernation.

Using full disk encryption isn't even a great solution, many Linux installers only encrypt the swap with the same master key as is used for your system partition. Ideally swap should be encrypted with a random key generated each boot. This means on shutdown the key is purged from memory and swap is, for all intents and purposes, irrecoverable. However in the current LVM-on-LUKS setups as used by Debian, Ubuntu, et al. the swap persists and your system key can be used to reveal your past activities. Infact previously "Full Disk Encryption" solutions like Bitlocker used to write to a hibernation file outside of the encrypted partition, meaning your encryption key for the disk was written in plaintext...to the disk. So everything your computer was doing at the time of hibernation (or the last time it hibernated) would be readable by anyone with physical access.

Be very careful when second guessing the design decisions of, and especially the large warning signs created by, the Tails team. They are not arbitrary decisions.

Improve this answer
1
  • Out of curiosity, if one never hibernated (to disk I mean, not suspend to RAM) and has no swap, is your primary concern whether or not the VM is storing information somewhere (like a log or some ~/. file)?
    – Hendy
    Jul 8, 2017 at 20:46
0

If you are using your own computer, it is probably safe. If you worry about backdoors, read the source code of linux, compile it, and use it.

Improve this answer
6
  • Quick question, if I use my laptop to a coffee shop / some place that offers WiFi, is there a possibility of being tracked?
    – Chandra Shekhar
    Apr 18, 2016 at 4:48
  • see superuser.com/questions/398776/tor-public-wi-fi-safe
    – v7d8dpo4
    Apr 18, 2016 at 7:05
  • and how to stop virtual box from monitoring what I'm doing while using Tails?
    – Chandra Shekhar
    Apr 18, 2016 at 13:29
  • By default, virtualbox doesn't record your activities.
    – v7d8dpo4
    Apr 18, 2016 at 13:34
  • "Both the host operating system and the virtualization software are able to monitor what you are doing in Tails."
    – Chandra Shekhar
    Apr 18, 2016 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .