There’s even a possibility of VM escape, perhaps utilizing integrations between guest and host.
Best idea would be separate hardware, but there’s also a chance of malware being embedded into UEFI, so perhaps a way to read/write the chip from external device would be good too.
But perhaps other device firmware could be exploited as well, if there’s something supporting updates.
And maybe it could then connect with vulnerable Bluetooth and WiFi devices, so it would be good to physically remove those.
Perhaps I am a little too paranoid, but I feel like there’s almost always something to exploit.
VM escape is a sophisticated attack. My point was that distrobox is the opposite of a isolated environment. And even the underlying software (Docker, Podman, and LXC) is not a proper boundary against malware. LPEs are quite common now and super easy to exploit. A VM is much better suited for this job.
There’s even a possibility of VM escape, perhaps utilizing integrations between guest and host.
Best idea would be separate hardware, but there’s also a chance of malware being embedded into UEFI, so perhaps a way to read/write the chip from external device would be good too.
But perhaps other device firmware could be exploited as well, if there’s something supporting updates.
And maybe it could then connect with vulnerable Bluetooth and WiFi devices, so it would be good to physically remove those.
Perhaps I am a little too paranoid, but I feel like there’s almost always something to exploit.
VM escape is a sophisticated attack. My point was that distrobox is the opposite of a isolated environment. And even the underlying software (Docker, Podman, and LXC) is not a proper boundary against malware. LPEs are quite common now and super easy to exploit. A VM is much better suited for this job.