Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

2/21/2007
07:30 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

VMs Create Potential Risks

Convenient and efficient, virtual machines can also increase your security exposure

Those tens of thousands of virtual servers spawned from your thousands of physical ones offer no guarantee your security policies will carry over, and can leave you with a security time bomb ticking away in your data center, according to vendors and some experts.

"Virtualization is both an opportunity and a threat," says Patrick Lin, senior director of product management for VMWare. "But one of the key things about hypervisors is their design is simpler than the modern operating system. As a result, they are simpler to harden and lock down, and there are not as many vulnerabilities."

"On the flip side, it's a new layer that's another opportunity for attack," he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. IBM won't give specifics on its internal plans for the technology, but it has provided some elements of SHype to the Xen Open Source Project. (See Vendors Push Virtual Security.)

And VMWare's desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. "And every application running in a modern IT organization is on a path to being moved to one big iron [machine] running multiple VMs," he says. "And its impact on security touches everything."

That has prompted some security vendors to step up. Allwyn Sequeira, senior vice president of product operations for Blue Lane Technologies, says virtualization is creating a tornado of forces that could blow away security as we know it: the new hypervisor layer creating a new security attack vector; VM sprawl, where virtual machines become unmanaged and unprotected, and rogue VMs emerge; and in the dynamic moves and changes model of VM, patching and testing cycles get disrupted, mismatched, and complex.

"Some say virtualization of the OS doesn't change anything, and others, that with virtualization, everything is broken," Sequeira says. "I think it's somewhere in the middle."

Sequeira wouldn't comment on Blue Lane's upcoming announcement in the virtualization space, but there's a pretty big hint on its Website: "Coming soon: Virtual Security for VMware's ESX hypervisor."

Security analysts caution against over-reaction. "We are still very early on in the whole virtualization thing," says Michael Rothman, president of Security Incite. "The real threats end up being more theoretical than real now... But over time, this will become a real challenge."

"It also changes the definition of what is an application, where does the data reside," he says. "And how do I end up securing it? To me, this is going to create another situation where you have to look at security from the outside in."

And virtualization technology itself isn't inherently insecure. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano's Ptacek notes. It's more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.

"So you design it the same way you design a secure network. You partition sensitive applications to sensitive servers, and consolidate the less sensitive ones onto the same hardware."

Ptacek says the biggest security risk with virtualization to watch out for are "guest-to-guest attacks," where an attacker gets the root or administrator privileges on the hardware, and then can hop from one virtual machine to another. "This assumes the attacker has already broken into one of the machines," he says, and it puts other apps at risk on the compromised machine.

But this type of attack isn't easy to execute, especially when cryptography is involved. But with a lot of math, an attacker can "infer some bits of the crypto secret," Ptacek adds.

There hasn't been much activity in VM bug disclosures as yet, but that will change as more apps use virtualization, he says, and then attackers will have fresh vulnerabilities to prey upon as well.

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches "don't cope with well," says Kevin Leahy, director of virtualization at IBM. "As you move virtual resources around, it adds another layer or dimension of complexity to it. You want to ensure that all security policies, access privileges, etc., that you put on the box originally will also be true with the new 'box' you put it on."

VMWare's Lin agrees that security should be part of the virtualization design. Aside from Ace, VMWare offers a virtual Layer 2 switch in its ESX Server -- a hypervisor -- with VLAN support, and the VMWare software lets you lock down virtual network adapters "from running in promiscuous mode," he says. VMWare also offers resource management and the ability to set user permissions.

"We built VMWare Infrastructure 3 architecture as secure as we can make it," Lin says. "But you also need to follow best practices in virtualization."

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • IBM Corp. (NYSE: IBM)
  • Matasano Security LLC
  • VMware Inc. (NYSE: VMW) Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Data Privacy Protections for the Most Vulnerable -- Children
    Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
    Sodinokibi Ransomware: Where Attackers' Money Goes
    Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
    Tor Weaponized to Steal Bitcoin
    Dark Reading Staff 10/18/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    2019 Online Malware and Threats
    2019 Online Malware and Threats
    As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-18218
    PUBLISHED: 2019-10-21
    cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
    CVE-2019-18217
    PUBLISHED: 2019-10-21
    ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
    CVE-2019-16862
    PUBLISHED: 2019-10-21
    Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
    CVE-2019-17409
    PUBLISHED: 2019-10-21
    Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
    CVE-2019-10715
    PUBLISHED: 2019-10-21
    There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.