VirtualBox - Guest Addons as a security risk to the Host PC?

Question

I'm setting up a Windows virtual machine in VirtualBox with the intent of using it as a sandbox for testing unknown or potentially dangerous applications.

My question: would installing the Guest Additions potentially open up my host PC for attack? I don't intend on sharing folders or passing through USB devices. Could malware somehow escape the hypervisor if Guest Additions was installed?

My host is Windows 7 Ultimate x64, and my guest will be Windows 7 as well.

Answer 1

Malware can, in theory, escape the virtual machine if there is any bug in the Guest Additions that allows that. This has happened with VMware once, and exists for VirtualBox, but it looks very unlikely to happen: a special malware would need to be crafted in order to do that.

A further discussion is in this IT Security question: Does a Virtual Machine stop malware from doing harm?. Those discussions there are also useful:

How secure are virtual machines really? False sense of security?

How to ensure that VirtualBox guests can't break out of the vm to get access to the host machine?

You definitely will want to disable networking in the VM, depending on what you're doing, this might be a source of infection for the host PC.

Answer 2

Even without guest extensions there could be a flaw in VirtualBox, allowing malware to attack the host system. Installing guest extensions will put you at higher risk, because the extensions allow closer access to the host system to enhance performance and thus allows more attack vectors.

While the risk is not that high in general, there have been such flaws in VirtualBox (and other virtualization software), see e. g. http://secunia.com/advisories/47626/

You should consider using dedicated hardware or at least leave out guest extensions and watch out for new flaws in VirtualBox, if you really want to be safe.