On Fri, 15 May 2020 17:29:31 +0530 Sreyan Chakravarty <sreyan32@xxxxxxxxx> wrote: > On 5/15/20 1:03 AM, stan via users wrote: > > If you are the only user on your machine, you almost certainly don't > > have to worry about this. > That is good to hear. > > The main threat of this attack was on cloud servers where many > > different users are running under virtual machines. > > This is the problem. I do some CTF practice from Kali Linux and I > also have a Windows 10 VM to try out various untrusted or malicious > software. Do those VMs have access to the internet? If they don't, they can't communicate their results even if they do perform the attack. When the VM closes, they lose all their results. > > think for single use systems, Tom's response is the correct one, > > but you can worry if you want. > Yeah, but what about single user systems that run a fair number of > VMs ? Well, unless you are the malicious attacker, they are still contained. You have control of the VM. And, if you don't run sensitive processes on the main machine while the VM is running and testing, then there is no sensitive data for any malicious attack to gather. It can only gather data from a process running on the same core at the same time. If your main system is idle while you are testing in the virtual machine, there is nothing for it to gather. To put your mind to rest, you will have to read the description of the exploit, determine for yourself the conditions that allow it, and prevent those conditions from occurring on your system. The simplest way is to do as I describe above, only run software that might be malicious in a VM (or on the main OS) while you are not doing sensitive operations on the main OS or on another VM on the same core; sensitive will primarily be surfing the web where you enter passwords for access. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
