1

We must connect to an external site using the VMware View Client installed on one of our workstations in our internal network. We don't trust the external site. Is there any chances that the VMware View Client installed on our workstation act as a backdoor for the external site where we will connect using the View Client?

enter image description here

The thing is that we don't want our workstation with the View client on it to be controlled by the external site. So is there a feature is View that allows that sort of behavior?

Jonathan Rioux
  • 1,878
  • 6
  • 33
  • 57

3 Answers3

1

As far as I can tell, no there are no features in the client that would let them control the workstation. It is possible however to redirect local drives to the remote server, which could be an issue if it is enabled.

If you don't trust them, I'd also recommend downloading the client from VMware's site, not from the external site - they could easily bundle it with other things that could control your computer.

Grant
  • 17,671
  • 14
  • 69
  • 101
0

Your only risk (if you got VMware from a safe source) are exploits in VMware. Not that hypervisors never got cracked in IT history...

If you are paranoid about that,

  1. either don't use the system for anything else and connect it directly (or via VLAN) to a router which prevents network traffic to anywhere else but the gateway (and perhaps DHCP server)
  2. or (if performance is not a problem) try to put VMware itself into a VM. Please mind that I know that this is possible with hypervisors but I don't know whether it is possible with VMware.
Hauke Laging
  • 5,157
  • 2
  • 23
  • 40
  • From Workstation 9 / ESXi 5.1 you can run VMware within itself. – Michael Hampton Feb 14 '13 at 19:52
  • It just comes to my mind that it probably only makes sense to combine different hypervisors. If you can crack the inner one why shouldn't you be able to crack the outer one with the same exploit? So VMware within KVM / Virtualbox is the more relevant question. – Hauke Laging Feb 14 '13 at 19:56
  • 1
    VMware won't run within KVM (yet). I've tried. VMware also warns against running it under Hyper-V. VirtualBox isn't worth mentioning; this is a site for professionals... – Michael Hampton Feb 14 '13 at 19:57
  • http://serverfault.com/questions/tagged/virtualbox – Hauke Laging Feb 14 '13 at 20:04
0

Regarding your question, you have to know that there are a couple of View nodes :

Agent / Client / Connection Server (Broker) / Security Server and Transfer Server.

You're asking if the VMware View client can be a backdoor and the question is not. As a client, it allows you to connect to smth, and not smth to connect to your client.

If you mean, View Agent, then it can be a breach only if your networking has badly been configured. A View agent with direct connection plugin (http://myvirtualcloud.net/?p=4150) might be a breach to your corporate environment, only if you do not respect the architecture guide provided by VMware. I mean if your DMZ / NAT / Firewall and authentication are not optimum Page 72 - http://pubs.vmware.com/view-52/topic/com.vmware.ICbase/PDF/horizon-view-52-architecture-planning.pdf

Architecture Planning

Florian Bidabé
  • 334
  • 2
  • 10