<p>The host running a virtual machine has complete, unfettered access to its guest, there's no breaching or compromising necessary. It provides absolutely no additional security in your described situation. It is likely trivial to access ECDSA private key material even between two unrelated virtual machines on a single host due to sidechannel attacks. </p>

CC BY-SA 4.0
2019-06-19T18:27:59.907Z
So can a malicious process/malware on the host machine access the seed/private keys inside the Ledger Live desktop app running in the VM or for that matter the Ledger Nano S device connected to it? The Nano S device is connected to a USB port on the host machine so I'm guessing there's no getting around that?
ncruz
CC BY-SA 4.0
2019-06-19T22:41:08.370Z
No matter what, the host can always read the entire memory of the virtual machine and edit its disk. For USB devices it has absolute control over them and can read the traffic.
Claris
CC BY-SA 4.0
2019-06-19T10:02:08.070Z
2019-06-19T10:02:08.070Z
Claris
<p>I'm wondering if connecting a hardware wallet like a Ledger Nano S to the Ledger Live desktop app running on a computer that's connected to the internet not considered a 'fully cold' wallet setup. How about installing/running the Ledger Live app inside a VM that has the networking components disabled? I know that there is a possibility that VMs can be breached or compromised but I'm thinking that the probability of accessing the private seed or spend key would be low to non-existent.</p>

<p>Has anyone have experiences or research data on this subject?</p>

<wallet><currencies><bip32-hd-wallets>
What's the consensus on using a non-networked VM as a cold wallet/airgapped computer?
ncruz
# What's the consensus on using a non-networked VM as a cold wallet/airgapped computer?

(Asked by: username_0 on 2019-06-19)

I'm wondering if connecting a hardware wallet like a Ledger Nano S to the Ledger Live desktop app running on a computer that's connected to the internet not considered a 'fully cold' wallet setup. How about installing/running the Ledger Live app inside a VM that has the networking components disabled? I know that there is a possibility that VMs can be breached or compromised but I'm thinking that the probability of accessing the private seed or spend key would be low to non-existent.

Has anyone have experiences or research data on this subject?

**Tags:** wallet, currencies, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2019-06-19. Score: 3 | Accepted answer

The host running a virtual machine has complete, unfettered access to its guest, there's no breaching or compromising necessary. It provides absolutely no additional security in your described situation. It is likely trivial to access ECDSA private key material even between two unrelated virtual machines on a single host due to sidechannel attacks.

> **Comments:**
> **username_0**: So can a malicious process/malware on the host machine access the seed/private keys inside the Ledger Live desktop app running in the VM or for that matter the Ledger Nano S device connected to it? The Nano S device is connected to a USB port on the host machine so I'm guessing there's no getting around that?  
> **username_1**: No matter what, the host can always read the entire memory of the virtual machine and edit its disk. For USB devices it has absolute control over them and can read the traffic.  

---

