Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

2/21/2007
07:30 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

VMs Create Potential Risks

Convenient and efficient, virtual machines can also increase your security exposure

Those tens of thousands of virtual servers spawned from your thousands of physical ones offer no guarantee your security policies will carry over, and can leave you with a security time bomb ticking away in your data center, according to vendors and some experts.

"Virtualization is both an opportunity and a threat," says Patrick Lin, senior director of product management for VMWare. "But one of the key things about hypervisors is their design is simpler than the modern operating system. As a result, they are simpler to harden and lock down, and there are not as many vulnerabilities."

"On the flip side, it's a new layer that's another opportunity for attack," he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. IBM won't give specifics on its internal plans for the technology, but it has provided some elements of SHype to the Xen Open Source Project. (See Vendors Push Virtual Security.)

And VMWare's desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. "And every application running in a modern IT organization is on a path to being moved to one big iron [machine] running multiple VMs," he says. "And its impact on security touches everything."

That has prompted some security vendors to step up. Allwyn Sequeira, senior vice president of product operations for Blue Lane Technologies, says virtualization is creating a tornado of forces that could blow away security as we know it: the new hypervisor layer creating a new security attack vector; VM sprawl, where virtual machines become unmanaged and unprotected, and rogue VMs emerge; and in the dynamic moves and changes model of VM, patching and testing cycles get disrupted, mismatched, and complex.

"Some say virtualization of the OS doesn't change anything, and others, that with virtualization, everything is broken," Sequeira says. "I think it's somewhere in the middle."

Sequeira wouldn't comment on Blue Lane's upcoming announcement in the virtualization space, but there's a pretty big hint on its Website: "Coming soon: Virtual Security for VMware's ESX hypervisor."

Security analysts caution against over-reaction. "We are still very early on in the whole virtualization thing," says Michael Rothman, president of Security Incite. "The real threats end up being more theoretical than real now... But over time, this will become a real challenge."

"It also changes the definition of what is an application, where does the data reside," he says. "And how do I end up securing it? To me, this is going to create another situation where you have to look at security from the outside in."

And virtualization technology itself isn't inherently insecure. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano's Ptacek notes. It's more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.

"So you design it the same way you design a secure network. You partition sensitive applications to sensitive servers, and consolidate the less sensitive ones onto the same hardware."

Ptacek says the biggest security risk with virtualization to watch out for are "guest-to-guest attacks," where an attacker gets the root or administrator privileges on the hardware, and then can hop from one virtual machine to another. "This assumes the attacker has already broken into one of the machines," he says, and it puts other apps at risk on the compromised machine.

But this type of attack isn't easy to execute, especially when cryptography is involved. But with a lot of math, an attacker can "infer some bits of the crypto secret," Ptacek adds.

There hasn't been much activity in VM bug disclosures as yet, but that will change as more apps use virtualization, he says, and then attackers will have fresh vulnerabilities to prey upon as well.

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches "don't cope with well," says Kevin Leahy, director of virtualization at IBM. "As you move virtual resources around, it adds another layer or dimension of complexity to it. You want to ensure that all security policies, access privileges, etc., that you put on the box originally will also be true with the new 'box' you put it on."

VMWare's Lin agrees that security should be part of the virtualization design. Aside from Ace, VMWare offers a virtual Layer 2 switch in its ESX Server -- a hypervisor -- with VLAN support, and the VMWare software lets you lock down virtual network adapters "from running in promiscuous mode," he says. VMWare also offers resource management and the ability to set user permissions.

"We built VMWare Infrastructure 3 architecture as secure as we can make it," Lin says. "But you also need to follow best practices in virtualization."

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • IBM Corp. (NYSE: IBM)
  • Matasano Security LLC
  • VMware Inc. (NYSE: VMW) Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Aviation Faces Increasing Cybersecurity Scrutiny
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
    Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
    Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
    Capital One Breach: What Security Teams Can Do Now
    Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    The State of IT Operations and Cybersecurity Operations
    The State of IT Operations and Cybersecurity Operations
    Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-15540
    PUBLISHED: 2019-08-25
    filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
    CVE-2019-15538
    PUBLISHED: 2019-08-25
    An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
    CVE-2016-6154
    PUBLISHED: 2019-08-23
    The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
    CVE-2019-5594
    PUBLISHED: 2019-08-23
    An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
    CVE-2019-6695
    PUBLISHED: 2019-08-23
    Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.