VMware uses 10,000 rounds of stronger PBKDF-SHA1 hash to derive the encryption key from the password. However, its real-world protection is a night and day difference to Parallels. VMvare uses the same AES-128 encryption algorithm. This speed is fast enough to discover simple passwords using plain old brute force, while the more complex ones will still require the use of dictionaries and mutations.

With this kind of speed, the recovery of reasonably complex passwords is possible even without GPU acceleration. We’ve been able to reach the speed of some 19 million passwords per second on a single Intel i7 CPU.

As a result, Parallels is the fastest to attack. While Parallels uses the AES-128 CBC algorithm to encrypt the data, the encryption key is derived with a measly two iterations of a dated MD5 hash function. Parallels has the weakest protection of the trio. Let us have a look at what the developers of the three VMs do to protect their content. However, the encryption strength and the resulting password recovery speeds are vastly different between these VMs.

The most common virtual machines that can encrypt the entire image are Parallels, VMWare, and VirtualBox. We built a tool to enable experts run hardware-accelerated distributed attacks on passwords protecting encrypted VM images created by VMWare, Parallels, and VirtualBox. Evidence stored in encrypted VM images can be only accessed if one can produce the original encryption password. Many types of virtual machines used in the criminal world feature secure encryption. The ability to analyze virtual machines becomes essential when performing digital investigations. Activities performed under the virtual umbrella leave trails mostly in the VM image files and not on the host computer. Virtual machines use a portable, hardware-independent environment to perform essentially the same role as an actual computer.

Vmware vs virtualbox security