In this lecture, I'd like to talk about a really, really cool virtual machine type and cubes.
The final type that we haven't spoke about yet is the disposable virtual machines.
Now, as the name suggests, these machines are designed to allow you to run any files or any data or
any websites that you really want to run.
But at the same time, you're not sure whether you should trust this data or whether you should trust
this file or website or not.
The whole idea is when you start a disposable virtual machine, cubes will create this virtual machine,
unlike what happens with all of the other machines.
Cubes will start an existing machine.
In the case of the disposable virtual machine, when you start one.
Cubes will create a new virtual machine.
You will use it.
And then when you're done, when you turn it off, cubes completely destroys this machine.
So the next time you start a disposable machine, you will start a completely new virtual machine.
Now, just like all of the other virtual machines, this virtual machine is completely isolated.
So if it gets compromised, if it gets hacked, it uses different resources and different file system.
So it is very difficult for a hacker, even if he manages to hack into the disposable virtual machine
to move on and hack into the other virtual machines that you have inside cubes.
Not only that, as soon as you turn off this virtual machine, like I said, the whole virtual machine
is destroyed.
So even if they have some kind of a persistent malware, or even if they are trying to exit the disposable
virtual machine and move somewhere else, their connection will be completely disconnected because the
whole virtual machine will be destroyed.
So over and over this, just like any other virtual machine we have inside cubes, you can see that
we can launch a number of programs, mainly Firefox and the terminal, and then you can enter the cube
settings.
This is pretty much everything you'll need.
So for example, let's say you're using your work virtual machine right here.
So I have a Firefox instance in my work domain, as you can see here.
And let's say you got an email that appears like it came from an address that you trust, whether it's
a friend's address or an address of your boss or an address of a company that you work with.
So you really want to click on a link that's inside this email, but at the same time, you're not sure
if this link is safe to click on or not.
Because keep in mind, hackers could have hacked into your boss or into your friend and then sent you
that email.
Or they can actually send emails that look like they're coming from other people.
And I actually show how to do this in my social engineering course.
And I showed this off in my talk at the Global Cybersecurity Summit in Orlando.
I will include a link to the talk in the resources of this lecture.
And if you're interested in my other courses, check out the bonus lecture, the last lecture of the
course anyway, so you can get an email that looks like it's coming from an address that you trust,
and the email could ask you to click on link.
Now clicking on this link could result into you getting hacked, but at the same time, because you
trust this address, you actually want to click on the link.
So the best solution for this is to go and start Firefox inside a disposable virtual machine.
Like I said, this will create a completely new virtual machine.
And inside this completely new virtual machine, it will start a Firefox instant.
And perfect.
As you can see, we get a normal Firefox browser.
So what you want to do is let's pretend that this is the email that you got.
All you'll have to do is copy the link that you want to open.
You don't want to open it in here.
You just want to click on copy link location.
This will copy it within the clipboard of this virtual machine of the work domain.
So you'll have to do control shift C to put it in the global clipboard, go to the virtual machine where
you want to paste it again.
I covered this in details before, so I'm doing it quick.
If you don't remember how to do it, go and revise that lecture.
So we go to the virtual machine where we want to paste this text.
We're going to do Control Shift V to paste it in the clipboard of this virtual machine and then Control
V to paste it in my URL.
And here, as you can see, and I have the link right now in here, so all I have to do is just hit
enter and that'll load the link for me inside this completely isolated, disposable virtual machine.
So let's assume that this link exploits some kind of a vulnerability that will allow the hacker to hack
into my computer.
They will gain control over this disposable virtual machine, but they won't be able to exit out of
it and do anything else.
And then as soon as I click on the X in here, the whole virtual machine will be shut down and it will
be destroyed.
So the next time I run a disposable virtual machine, I'll actually be running a completely new virtual
machine that does not contain the malware, even if it was downloaded using the previous session.
So that's really, really cool, but it doesn't stop there.
Let's assume that you really want to open this file, but at the same time this file is downloaded from
the internet or from an email, so you can't really trust it, even if it's coming from a trusted email.
Like I said, someone could have hacked into the account that sent you the email, or someone could
be pretending to be that email, but they're not.
So if you really want to open this file, all you have to do is right click the file.
Instead of clicking open with Lever Office, you want to go to view in a disposable virtual machine.
Clicking on this will create a completely new virtual machine like we seen before, and then opens the
file inside this disposable virtual machine.
And once you close it, the whole virtual machine will be destroyed.
The file will be removed from the virtual machine, and even if the file contained malware, the malware
will not be able to exit that virtual machine and affect your work computer in here because again,
they are two completely separate operating systems.
Now, I'm not going to show you that because it's very simple.
All you have to do is literally click on view in a disposable virtual machine, and it will work as
expected.
What I really want to show you and what I think is really cool is the edit in a disposable virtual machine
option.
So with this option, again, it will create a new disposable virtual machine, but it will open the
file for editing.
For me this way, not only I'll be able to read the file, I'll also be able to edit the file, save
it, make changes to it.
For example, if I was asked to fill something or to sign the file, I'll be able to do that.
So for example, let's just type test and I'm going to do control as to save it.
We'll keep it at Microsoft Word 97 format.
And now I can go ahead and send this file back knowing that even if this file contained malware, it
did not affect my domain.
Now, just to show you you're not supposed to do this, but just to show you that the changes were saved,
I'm going to double click this file just to open it here, just to save time.
And we have it here.
And as you can see what I added in here, test it saved and it is contained within the document.
So this way, not only that, you can view documents safely, you can also edit them safely without
affecting the security domain that you're working in.
And if this wasn't enough, there is another really cool feature that you can do for images and for
PDFs.
This really cool feature allows you to not only view the file in a different disposable virtual machine,
but you can also convert the file to a trusted PDF.
So again, regardless of how you got this PDF, whether you got it from a friend, from an email, from
the internet, let's assume that you have a PDF that you really, really want to run.
What you can do is you can right click and view in a disposable virtual machine.
That's fine.
Or you can click on convert to a trusted PDF.
What this will do is it will, first of all, create a new disposable virtual machine.
It will copy the PDF to this new virtual machine.
It will use a complex process in order to make sure that the PDF contains no malware and also completely
destroy the PDF and convert the data and this PDF into images.
At the end you'll notice we have a new file in here.
This is called sample dot trusted dot pdf, so it added the word trusted to our pdf.
And this pdf right here is a completely clean version of the original PDF.
So not only that we can open this PDF in our current domain safely knowing that it contains no malware,
but you can also go ahead and send it to others.
So let's assume you need to send this to a colleague or to a friend.
But you're not sure if this PDF is clean, then this way you can clean the PDF and make sure that it
contains no malware.
At the same time, you can find the original PDF.
If you go to home and scroll down, you'll see we have a new directory called Cubes Untrusted PDFs,
and in here you'll see the original PDF that we converted to a trusted pdf.
So that's it for now.
I think this is a really, really cool feature in Cubes and it can really prevent a lot of attacks because
like I said, hackers can hack into your friends or into your colleagues or into other companies accounts
and then social engineer you into clicking on links or downloading files.
And this happens all the time in companies.
And like I said, I showed off a lot of these scenarios in my global cybersecurity summit.
So if you're interested, go have a look on that.
I will include the link to the video in the resources and basically at the end of it, a lot of people
were asking, so how can we prevent this?
Well, the only solution is, first of all, education, educate the employees.
But at the same time, like I said, you might get a file or document or a link from someone that you
trust.
And even though you might think that this could be suspicious, at the same time, you forget if you're
getting this from your boss or if you're getting this from a company that you do business with, you
really need to open the file anyway.
Or if you're a security researcher again, in many cases you want to open the file anyway.
So this is a really, really good way of handling untrusted files.