Device-Emulation Attack Surface Lab
Every emulated device in a VM is code running in the host’s hypervisor process — and a hostile guest gets to drive it. That is why VENOM lived in an emulated floppy controller nobody was using. You are handed a VM’s device list: keep the virtioparavirtual devices and the handful the workload truly needs, and strip the rest — the floppy controller, the redundant legacy NIC, the sound card, the headless graphics stack, the host-folder share. The catch: cut something load-bearing (the serial console, the balloon, the ops-agent channel) and you break the server. Find the smallest machine model that still runs.
The real job. More noise, a tighter clock.
Machine model review
A headless production Linux web server VM. No graphical console, no audio, no removable media after install. It is reached over SSH and HTTPS, and a host-side ops agent manages it.
Keep what it needs; remove the rest. Every emulated device is code in the host process.
#1 · paravirtual NIC
virtio-net
The paravirtual network interface the server uses for all traffic.
#2 · paravirtual disk
virtio-blk
The paravirtual block device backing the root filesystem.
#3 · entropy source
virtio-rng
Feeds host entropy to the guest so TLS/crypto has a healthy random pool.
#4 · platform
RTC / PIT timers + base chipset
The real-time clock, timers and minimal chipset the guest OS boots against.
#5 · legacy storage
Floppy disk controller (FDC)
The emulated floppy controller, present in the machine model though no floppy drive is attached.
#6 · audio
AC97 / ICH6 sound card
An emulated audio device included by a default desktop-style machine profile.
#7 · legacy NIC
e1000 legacy NIC
A fully-emulated Intel e1000 NIC configured IN ADDITION to virtio-net.
#8 · input/USB
USB tablet + UHCI controller
A USB host controller and tablet pointer device, used for a graphical console pointer.
#9 · removable media
IDE/SATA CD-ROM (installer ISO attached)
An emulated optical drive with the OS installer ISO still mounted after provisioning.
#10 · console
isa-serial console
A serial console used for headless boot logging and emergency out-of-band access.
#11 · legacy I/O
Parallel port (LPT)
An emulated parallel/printer port from a legacy machine profile.
#12 · memory mgmt
virtio-balloon
The paravirtual memory-ballooning device the host uses to reclaim/adjust guest RAM.
Surface vs. breakage
0/12 called · 0 broken · 0 left exposed.
How it is scored
Removing a device the workload needs breaks the server — the heaviest penalty.
Keeping a device the workload does not need leaves attack surface — a lighter bite.
The win is the smallest machine model that still runs. Harder tiers add devices that look legacy but are load-bearing (serial, balloon, vsock) and devices that look harmless but are pure surface.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based machine-model review: you are handed a VM's emulated device list and must keep what the workload needs and remove the unneeded or high-risk devices.
- Every emulated device is code running in the host's QEMU process, so each one is attack surface — a floppy controller (VENOM), a legacy e1000 NIC, a sound card, a headless graphics adapter or a host-folder share you never use is surface for nothing.
- But removing a device the workload depends on breaks it, so the lab weighs attack surface left behind against breakage — and breaking the server bites hardest.
- Harder tiers add the two traps that matter: devices that look legacy but are load-bearing (serial console, virtio-balloon, vsock management channel) and devices that look harmless but are pure surface.
- Runs entirely in your browser — no account, no install, nothing sent anywhere.
Frequently asked questions
What is the Device-Emulation Attack Surface Lab?
A free, in-browser exercise where you review the emulated device list of a virtual machine and decide, device by device, whether to keep it or remove it. The goal is to minimise the VM's attack surface — because every emulated device is code in the host hypervisor process — without removing a device the workload actually needs. You are scored on how small you make the machine model while keeping the workload running.
Why is an emulated device an attack surface?
Because the hypervisor emulates each device in software, in a process on the host. A hostile guest drives those devices, so a bug in an emulated device model can be reached from inside the guest — VENOM was an out-of-bounds write in QEMU's virtual floppy controller, reachable even with no floppy attached, and legacy NIC and graphics emulation have their own histories. Removing devices the workload does not use removes that code, and the bugs that live in it.
So should I remove everything I can?
No — that is the trap the lab trains against. Some devices look legacy but are load-bearing: a headless server's serial console is its real management console, virtio-balloon is a legitimate memory lever, and the vsock channel may be how the host ops agent manages the VM. Removing one of those breaks the workload, which the lab penalises more heavily than leaving a little extra surface. The win is the smallest model that still runs.
Who is it for?
Platform and virtualization engineers who build VM images and machine models, security reviewers approving a virtualization build, and anyone who wants the instinct for minimal, defensible device surface. It is free and runs entirely client-side.