Risk
11/6/2012
10:54 AM
50%
50%

More VMware Source Code Leaks To Internet

Does the second release -- in less than a year -- of stolen VMware ESX source code put users at risk?

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
A new batch of stolen source code for VMware ESX, the company's enterprise-level virtualization product, has been posted to the Internet.

The code release was announced Sunday on Twitter by the hacker "Stun," who also posted a link to a 1.89-MB Torrent download file for what's labeled as "VMware ESX Server Kernel."

"VMware will try to make like this Kernel is old and isn't used in its recent products. But thanks god, there is still such as thing as reverse engineering that will prove it's true destiny," read the accompanying notes from Stun. In addition, he noted that the kernel dates from between 1998 and 2004. "But as we all know, kernels don't change that much in programs, they get extended or adapted but some core functionality still stays the same," he said.

[ Read Hackers Hit Symantec, ImageShack, But Not PayPal. ]

VMware Sunday confirmed that the published VMware ESX source code is genuine, and did highlight that the code dates from 2004.

This is the second time this year that stolen VMware ESX source code has been published on the Internet. The first such release occurred on April 23, when hacker "Hardcore Charlie" published a "sneak peak" of 300 MB of VMware ESX source code that he claimed to have obtained from China Electronics Import & Export Corporation (CEIEC), a defense contractor. At the time, CEIEC denied the hacker's claim, saying that "the information reported is totally groundless, highly subjective, and defamatory." It promised to take legal action against whoever had been responsible for the claims.

Interestingly, whoever released the VMware source code then might somehow have been involved in the latest release, despite the change of hacker handle. "This source code is related to the source code posted publicly on April 23, 2012," said Iain Mulholland, VMware's director of platform security, in a security bulletin, though he offered no additional details.

In addition, this might not be the last source code to be leaked. "It is possible that more related files will be posted in the future," Mulholland said. "We take customer security seriously and have engaged our VMware Security Response Center to thoroughly investigate."

He also urged all VMware ESX users to ensure that they've installed the latest patches, which would protect them against any publicly known vulnerabilities in the code. "By applying the combination of the most current product updates and the relevant security patches, we believe our customer environments will be best protected," he said.

But could the breach still leave VMware users unprotected? It's difficult to answer that question, and depends on whether attackers find new vulnerabilities in the published source code. In January, for example, when hacker Yama Tough released source code for Symantec's pcAnywhere -- after having failed to extort $50,000 from the antivirus company -- security experts warned that attackers reviewing the source code might discover unknown vulnerabilities that could be exploited via zero-day attacks.

Still, after Hacker Charlie -- who said he'd collaborated with Yama Tough -- released the first trove of VMware ESX source code, multiple security experts declined to speculate on whether the code release might put users at risk. Given that ESX serves as a guest operating system for virtualized environments, however, any working exploit could allow an attacker to launch an "escape to hypervisor" attack and gain access to any other virtual machine running on the same server.

Benchmarking normal activity and then monitoring for users who stray from that norm is an essential strategy for getting ahead of potential data and system breaches. But choosing the right tools is only part of the effort. Without sufficient training, efficient deployment and a good response plan, attackers could gain the upper hand. Download our Fundamentals Of User Activity Monitoring report. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This is a secure windows pc.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.