Oracle VirtualBox's Extension Pack isn't open-source like the base product. It's restricted for commercial use, and Oracle tracks downloads to identify potential customers for licensing enforcement. Penalties run per-socket or per-workstation, and the company has ways to detect if you're using it.
Chapters
Oracle, known for their large legal department and lust for launching software audits, has recently found a new way to slip their long legal arms into your company's pocketbook. How do they do this, you might ask? Well, it comes from the inconspicuous, seemingly innocuous VM VirtualBox software. If you suspect the this software has been downloaded and installed in your environment, you may be at risk of being harassed or asked to pay a fine by Oracle VirtualBox sales reps. But don't worry. In this video I will explain to you what VirtualBox is, what's inside the software that increases your Oracle audit exposure, how Oracle uses it as a means of entry into your business's pocketbook. And if you stick around long enough, I'll even show you how to check if it's floating around in your environment. So let's get into it. If you're watching this video, you know that Oracle VM VirtualBox is an open source software used to help you keep track, manage and create virtual machines from on your laptop all the way to on your high end server setup. But did you know that while Oracle VirtualBox falls under the GNU General Public License version 2, it has components you may be using right now that fall outside of that GPL and can increase your risk of Oracle sales reps knocking at your door asking for you to pay a fine. Well, sadly it's true, and Oracle has been reaching out more and more to collect their VMBOX payments. But to understand which component is the culprit, let's break down what's inside this VirtualBox software. There are three parts to the VirtualBox the basic package, Extension pack and Guest additions. I like to think of this software as a car. The base package is like the frame of the car. It's the heart of this application and holds the key functionalities of this VM hypervisor. The guest additions are installed on the guest VM and they provide a nicer user experience. It's like the leather seat package in the car and the extension pack extends the functionality of the base package. When you install the extension pack you get virtual machine access to USB 2 and USB 3 devices on your host VirtualBox remote desktop protocol support, host, webcam, passthrough, Intel PXE boot, ROM and disk image encryption. And to put this back into car terms, these add ons in the extension package would basically be like the air conditioning, the heating and the speedometer. Very important. As you will soon find out. The basic package and the guest additions are free open source and are licensed under the GPL v2. However, the extension pack, which you can easily install as it has no paywall indicating you're installing a licensed product from Oracle, is distinctly not free and you need to buy a license for it if you're using it for commercial usage. And here lies the Oracle trap in plain sight. You see, when Oracle bought VirtualBox, they changed the extension pack to be licensed under the Personal Use and Evaluation License, the PUEL for short, which allows some free usage for educational institutions and single users, but excludes usage for commercial purposes. See, these major functionalities you gain from the extension pack are very attractive and necessary for the end user to have, as it helps them get their job done. So here's what happens. Oracle takes that list of recently downloaded VirtualBox extension packs and uses it as a prospecting means for new customers. However, when it comes down to it, downloading it and actually installing it is a conversation you need to have with your legal team. And while that's going on, double check if you did install it or remove it. According to this article, in the register that seen a company called Marula being targeted by Oracle for $12,000 in unpaid license fees, it's claimed that Oracle has this application phone home to notify them of IP addresses using it, or Oracle checks the IPs that have downloaded it and then contacts the addresses of those IPs to look for payment. If you're a heavy VirtualBox user. If you use it for any business processes or you have a hefty Oracle footprint, it's key to get your ducks in a row before Oracle comes knocking at your door. Let's talk about the penalties if you're found non compliant. Typically, the penalties of VirtualBox non compliance depends on how many IP addresses Oracle thinks are accessing it in your organization, and if your Oracle box is running on a singular person's computer or a server type setup. If they think that it's being used on a server type setup and people are accessing it, expect to pay $1,000 per socket and $50 per user's workstation found with it installed. Also, however, here's the thing. How Oracle determines this is up to them, so it's essential to know where and for what reason you have them installed. Which brings me to the next topic. Checking if it's in your environment. Now, there are two ways to check if this VirtualBox extension pack is floating around in your IT infrastructure. The first way is to look for the EXT pack license RTF file on any system or server in your environment. You can do this by looking in these directories. Depending on your operating system, the path could change if it's a custom install. You can also run this following command on your system as well. The problem with this way is that you'll have to manually check each system or server or get your employees to, which results in a lot of downtime and possibly some human error as well. The second way to check is to run our Read Only Active Directory Reporting tool which can give you a coverage report on the number of Oracle VirtualBox licenses you have in your organization. Our experts will also help you run a few scripts to see what additions are on there too. If you like to get your infrastructure analyzed, please click the link below to talk to our experts today. Thanks for watching this episode of the SAM Channel. I hope your Oracle compliance is solid as a rock. Don't forget, if you have any questions, feel free to post them in the comments below. And as always, keep your software safe and your assets managed.
