Question regarding Virtual Machines from a complete VM noob

[Euphoria]

Hey, so as I said in the title, I'm trying to learn the absolute basics regarding VMs'. So far I *think I understand what they are, sort of like a computer environment (OS, apps...) within a computer environment, please tell me if I'm incorrect.

 

Anyway, I'm trying to find out if a VM is going to work and be useful to me. I've started doing some work for a small business, creating a site, maintaining it, updating property listings... etc. So on a regular basis, they give me USB drives with .pdf, hundreds of photos, and more importantly zip files. Well, I don't want to be sticking some random USB drives into my system and unzipping what could be anything, so I thought a VM might be good for me.

So my question is; if I set up a VM, just a basic one (I don't know if there are different types) would I be safe while in a VM to open these random zip files and drives, would my actual OS and files be safe and protected from anything nasty, as I opened it while in a VM??

 

Appreciate any info, and sorry if this is a stupid or obvious question.

[hi mate]

yes you are correct. A VM will keep most of your computer safe (unless there is some kind of virus that may target VM's). try buying a chap PC second hand or whatever and unzipping everything on there and scanning it with updated windows defender before plugging into your PC. That may be a hassle, if so a VM should work fine (athough will slow down your PC compared to usual 

[Euphoria]

Hi, hi mate (cool handle by the way). Thank you for the info, that's great to hear, I will continue to learn as much as possible about VMs' and go with that.

 

Regarding what you said; although it will slow down your PC - Do you mean having a VM on the PC will slow it down just having it there, or do you just mean while using the VM it's slower? Similar to a game emulator, a super high-end PC can only emulate a PS2 and not a PS3 because of the processing power required to emulate??

[KuJoe]

A VM is just a virtual PC within a PC more or less so you are correct there. A VM might not offer you any protection from viruses on a USB drive, the USB will still need to physically plug into your computer so if the virus was designed to release the payload upon connection it won't help you. If the virus is in a zip file that you open on the VM then yes, your PC is probably safe (there have been known exploits that allow people to execute code on a VM and run commands on the host). Also, if the VM is on the same network as the rest of your network it might spread the virus via network shares so be careful of that also.

 

So to recap, if say somebody at the small business had a virus on their desktop and plugged in a USB to their desktop then handed the USB key to you and you plugged it into your desktop then you desktop is most likely infected before you even boot up your VM. If somebody at the small business had a virus, zipped it up, and put it on the USB key then your desktop is safe but your VM is infected and the employee at the small business is a jerk.

[sazrocks]

Yes you will be fine. However you will need to find a way to directly pci passthrough the usb controller (I would recommend getting an expansion card) you are plugging the usb drive into to the VM. This will likely require a linux host and something like KVM for the hypervisor. If you run windows as a normal OS (which I'm guess you are) this will be impractical and I would just suggest getting some crap old PC, keep it unplugged from the network and use that to check the drive first (run malwarebytes, etc.), and perform weekly re-imaging on it.

[Sniperfox47]

Also one thing to keep in mind, while this may protect you from software attacks (especially if you pass through the whole controller), it's not going to help with hardware attacks. Things like a USB Killer will still damage your device regardless of whether you have the software side isolated to a VM or not.

[Euphoria]

Great stuff, thank you everyone, I really appreciate the help and info. I'll keep learning about VMs' but just to be safe, I'll look out for a cheap old system or raspberry pi to check them first before plugging into my main systems.

Thanks again.