Comment by vetrom
7 days ago
Run say a linux firewall vm with PCI nic passthrough and give the host windows machine a virtio-pci/TAP interface as its network access is one countermeasure off the top of my head I can think of.
7 days ago
Run say a linux firewall vm with PCI nic passthrough and give the host windows machine a virtio-pci/TAP interface as its network access is one countermeasure off the top of my head I can think of.
Agreed, running it inside a vm is how you would treat any other malware. Why pci passtrough instead of a regular virtio network driver though?
I'm imagining a situation where you need to run windows on the host, but you do not want windows itself arbitrating network access -- so you pass through the real NIC to the vm, and route through the vm with a virtio (I think TAP is actually the only option host-side though but still) NIC.
Ah, I see. Given that you can even pass disks, gpu's, usb devices etc via pci, I would always choose the opposite route: run windows in a vm.