Security of Operating Systems in Virtual Environments

Author

Michał Kochanowicz Field of Study: Technical Computer Science (Master’s degree, full-time)

Supervisor

Dr. inż. Przemysław Marynowski

Organizational Unit

Faculty of Metals Engineering and Industrial Computer Science

Thesis Language

Polish [PL]

---

Abstract

The thesis involved testing the security of popular operating systems (Windows 10 and Ubuntu 22.04 LTS) running in a virtual environment. The analysis included (where possible) a comparison of the security of virtualized systems with native ones in similarly configured setups, as well as an examination of whether virtualization introduces new attack vulnerabilities. The motivation was to create a comprehensive comparison enabling the assessment of virtualization’s impact on security levels and the identification of differences resulting from the specific characteristics of operating systems.

The thesis is divided into main parts: a theoretical section presenting academic knowledge of the discussed issues, and a research section based on security testing. The tests focused on network attacks (sniffing, ARP spoofing, brute force), privilege escalation, and the evaluation of vulnerabilities in integration channels between host and guest systems (shared clipboard and shared folders).

The primary tool used in the study was VMware Workstation Pro, a platform for creating virtual machines with advanced configuration options. Network attacks were conducted using tools built into Kali Linux (installed on a separate machine), including Wireshark. Privilege escalation was tested mainly within the examined systems, under various privilege configurations.

The expected outcome was to confirm the thesis that the security of operating systems in virtual machines is generally comparable to native systems, though their risk profiles differ. The virtual environment should not significantly affect susceptibility to network attacks or privilege escalation. The differing risk profile may stem from the specifics of virtualization, such as enhanced security regarding access to USB/PCI devices, while simultaneously introducing new vulnerabilities related, for example, to the shared space between a virtual machine and the host system.

---

Table of Contents

1. Introduction

2. Theoretical Background

3. Test Environment

4. Security Tests

   • 4.1 Packet Sniffing
   • 4.2 ARP Spoofing
   • 4.3 Brute-Force Attack
   • 4.4 Privilege Escalation

5. Conclusion and Findings

6. References

7. Appendix A – Source Code of the Brute-Force Test Application

---

Thesis Status

• Defense Date: October 20, 2025

---

For questions or collaboration inquiries, please contact me via GitHub.