I’ve been issued a work laptop with Windows 11, running the Sophos Endpoint Agent, which monitors all web traffic and processes running on the PC and blocks malicious stuff.
If I install a Linux VM on it and access the web from inside it, will the Endpoint Agent see what I’m doing and be able to block access the same way as it does on the host?
I guess what I’m asking is, how does accessing a website from inside a VM work, actually? Does all the traffic get routed through the host OS unencrypted?
The purpose isn’t to try to circumvent any security measures or go over the heads of the IT department, but rather to find out if I can make a case for using my favorite OS on this thing without compromising security.
I don’t know for sure, but I don’t think they’d be able to read https traffic. That would be encrypted on the vm itself before being sent to the host, so the host couldn’t see it.
If they’re scanning your system remotely for unapproved software, I imagine they won’t let you use a vm at all, since it kinda breaks that requirement.
But they’re able to access your screen, keylog you and read your HD. No need to read https if you can access what the user sees and does
Also your DNS traffic will leak what you are doing.
Just follow the most upvoted answer and keep personal stuff on your personal PC or mobile if you want to avoid trouble.
You can use DoT or DoH.
But you will still leak SNI.