In this lecture I'd like to talk about a really really cool virtual machine type and cubes.
The final tapes that we haven't spoke about yet is the disposable virtual machines.
Now as the name suggests these machines are designed to allow you to run any files or any data or any
Web sites that you really want to run.
But at the same time you're not sure whether you should trust this data whether you should trust this
file or Web site or not.
The whole idea is when you start a disposable virtual machine cubes will create this virtual machine
unlike what happens with all of the other machines cubes will start an existing machine.
In the case of the disposable virtual machine when you start one cubes will create a new virtual machine.
You will use it.
And then when you're done when you turn it off cubes completely destroys this machine.
So the next time you start a disposable machine you will start a completely new virtual machine.
Now just like all of the other virtual machines this virtual machine is completely isolated.
So if it gets compromised if it gets hacked it uses different resources and different file system.
So it is very difficult for a hacker even if he manages to hack into the disposable virtual machine
to move on and hack into the other virtual machines that you have inside cubes.
Not only that as soon as you turn off this virtual machine like I said the whole virtual machine is
destroyed.
So even if they have some kind of a persistent malware or even if they are trying to exit the disposable
virtual machine and move somewhere else their connection will be completely disconnected because the
whole virtual machine will be destroyed.
So hovering over this just like any other virtual machine we have inside cubes you can see that we can
launch a number of programs mainly Firefox and the terminal and then you can enter the cube settings.
This is pretty much everything you'll need.
So for example let's say you're using your work virtual machine right here.
So I have a Firefox instance in my work domain as you can see here.
And let's say you got an email that appears like it came from an address that you trust whether it's
a friend's address or an address of your boss or an address of a company that you work with.
So you really want to click on a link that's inside this e-mail.
But at the same time you're not sure if this link is safe to click on or not because keep in mind hackers
could have hacked into your boss or into your friend and then sent you that email or they can actually
send emails that look like they're coming from other people and they actually show how to do this in
my social engineering course.
And I showed this off in my talk at the global cybersecurity summit in Orlando.
I will include a link to the talk and the resources of this lecture.
And if you're interested in my other courses check out the bonus lecture.
The last lecture of the course anyway.
So you can get an e-mail that looks like it's coming from an address that you trust.
And the e-mail could ask you to click on a link.
Now clicking on this link could result into you getting hacked.
But at the same time because you trust this address you actually want to click on the link.
So the best solution for this is to go and start Firefox inside a disposable virtual machine.
Like I said this will create a completely new virtual machine.
And inside this completely new virtual machine it will start a Firefox instant and perfect as you can
see we get a normal Firefox browser.
So what you want to do is let's pretend that this is the email that you got.
All you'll have to do is copy the link that you want to open.
You don't want to open it in here.
You just want to click on copy link location.
This will copy it within the clipboard of this virtual machine of the work domain.
So you'll have to do controls shift C to put it in the global clipboard.
Go to the virtual machine where you want to paste it.
Again I cover this in details before I'm doing it quick.
If you don't remember how to do it go and revise that lecture.
So we go to the virtual machine where we want to piece this text.
We're going to do control shift V to paste it in the clipboard of this virtual machine and then control
V to paste it in my URL in here as you can see and I have the link right now in here so all I have to
do is just hit enter and that to load the link for me inside this completely isolated disposable virtual
machine.
So let's assume that this link exploits some kind of a vulnerability that will allow the hacker to hack
into my computer.
They will gain control over this disposable virtual machine but they won't be able to exit out of it
and do anything else.
And then as soon as I click on the X in here the whole virtual machine will be shut down and it will
be destroyed.
So the next time I run a disposable virtual machine I'll actually be running a completely new virtual
machine that does not contain the malware even if it was downloaded using the previous session.
So that's really really cool.
But it doesn't stop there.
Let's assume that you really want to open this file but at the same time this file is downloaded from
the Internet or from an e-mail.
So you can't really trust it even if it's coming from a trusted e-mail.
Like I said someone could have hacked into the account that sent you the email or someone could be pretending
to be that e-mail but they're not.
So if you really want to open this file all you have to do is right click the file instead of clicking
open with libre office.
You want to go to view in a disposable virtual machine clicking on this will create a completely new
virtual machine like we seen before and then opens the file inside this disposable virtual machine.
And once you close it the whole virtual machine will be destroyed the file will be removed from the
virtual machine.
And even if the file contained malware the malware will not be able to exit that virtual machine and
affect your work computer in here because again they are two completely separate operating systems.
Now I'm not going to show you that because it's very simple.
All you have to do is literally click on view in a disposable virtual machine and it will work as expected.
What I really want to show you and what I think is really cool is the edit and a disposable virtual
machine option.
So with this option again it'll create a new disposable virtual machine but it will open the file for
editing for me.
This way not only I'll be able to read the file.
I'll also be able to edit the file save it make changes to it for example if I was asked to fill something
or to sign the file I'll be able to do that.
So for example let's just type test and I'm gonna do control as to save it.
We'll keep it to Microsoft Word 97 format and now I can go ahead and send this file back knowing that
even if this file contained malware it did not affect my domain.
Now just to show you you're not supposed to do this but just to show you that the changes were saved.
I'm gonna double click this file just to open it here just to save time and we have it here.
And as you can see what I added in here test it saved and it is contained within the document.
So this way not only that you can view documents safely.
You can also edit them safely without affecting the security domain that you're working in and if this
wasn't enough there is another really cool feature that you can do for images and for PDX.
This really cool feature allows you to not only view the file in a different disposable virtual machine
but you can also convert the file to a trusted PPF.
So again regardless of how you got this PPF whether you got it from a friend from an email from the
Internet let's assume that you have a PDA that you really really want to run what you can do is you
can right click and view in a disposable virtual machine.
That's fine or you can click on convert to a trusted PDA.
What this will do is it will first of all create a new disposable virtual machine that will copy the
PDA to this new virtual machine.
It will use a complex process in order to make sure that the PDA contains no malware and also completely
destroyed the PDA F and convert the data.
And this PDA F into images at the end you'll notice we have a new file in here.
This is called sample dot trusted dot PDA.
So it added the word trust it to our PDA.
And this PDA right here is a completely clean version of the original PDA F.
So not only that we can open this PDA F in our current domain safely knowing that it contains no malware
but you can also go ahead and send it to others.
So let's assume you need to send this to a colleague or to a friend but you're not sure of this PDA
fiscally and then this way you can clear the PDA off and make sure that it contains no malware.
At the same time you can find the original PDA.
If you go to Home and scroll down you'll see we have a new directory called cubes untrusted PDA Fs.
And in here you'll see the original PDA eff that we converted to a trusted PDA F so that's it for now.
I think this is a really really cool feature and cubes and it can really prevent a lot of attacks because
like I said hackers can hack into your friends or into your colleagues or into other companies accounts
and then social engineer you into clicking on links or downloading files.
And this happens all the time and companies and like I said I showed off a lot of these scenarios in
my global cybersecurity summit.
So if you're interested go have a look on that.
I will include a link to the video in the resources and basically at the end of it a lot of people were
asking so how can we prevent this.
Well the only solution is first of all education.
Educate the employees but at the same time like I said you might get a file a document or a link from
someone that you trust.
And even though you might think that this could be suspicious at the same time you forget.
If you're getting this from your boss or if you're getting this from a company that should do business
with you really need to open the file anyway or if you're a security researcher again in many cases
you want to open the file anyway.
So this is a really really good way of handling untrusted files.