Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

2/21/2007
07:30 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

VMs Create Potential Risks

Convenient and efficient, virtual machines can also increase your security exposure

Those tens of thousands of virtual servers spawned from your thousands of physical ones offer no guarantee your security policies will carry over, and can leave you with a security time bomb ticking away in your data center, according to vendors and some experts.

"Virtualization is both an opportunity and a threat," says Patrick Lin, senior director of product management for VMWare. "But one of the key things about hypervisors is their design is simpler than the modern operating system. As a result, they are simpler to harden and lock down, and there are not as many vulnerabilities."

"On the flip side, it's a new layer that's another opportunity for attack," he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. IBM won't give specifics on its internal plans for the technology, but it has provided some elements of SHype to the Xen Open Source Project. (See Vendors Push Virtual Security.)

And VMWare's desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. "And every application running in a modern IT organization is on a path to being moved to one big iron [machine] running multiple VMs," he says. "And its impact on security touches everything."

That has prompted some security vendors to step up. Allwyn Sequeira, senior vice president of product operations for Blue Lane Technologies, says virtualization is creating a tornado of forces that could blow away security as we know it: the new hypervisor layer creating a new security attack vector; VM sprawl, where virtual machines become unmanaged and unprotected, and rogue VMs emerge; and in the dynamic moves and changes model of VM, patching and testing cycles get disrupted, mismatched, and complex.

"Some say virtualization of the OS doesn't change anything, and others, that with virtualization, everything is broken," Sequeira says. "I think it's somewhere in the middle."

Sequeira wouldn't comment on Blue Lane's upcoming announcement in the virtualization space, but there's a pretty big hint on its Website: "Coming soon: Virtual Security for VMware's ESX hypervisor."

Security analysts caution against over-reaction. "We are still very early on in the whole virtualization thing," says Michael Rothman, president of Security Incite. "The real threats end up being more theoretical than real now... But over time, this will become a real challenge."

"It also changes the definition of what is an application, where does the data reside," he says. "And how do I end up securing it? To me, this is going to create another situation where you have to look at security from the outside in."

And virtualization technology itself isn't inherently insecure. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano's Ptacek notes. It's more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.

"So you design it the same way you design a secure network. You partition sensitive applications to sensitive servers, and consolidate the less sensitive ones onto the same hardware."

Ptacek says the biggest security risk with virtualization to watch out for are "guest-to-guest attacks," where an attacker gets the root or administrator privileges on the hardware, and then can hop from one virtual machine to another. "This assumes the attacker has already broken into one of the machines," he says, and it puts other apps at risk on the compromised machine.

But this type of attack isn't easy to execute, especially when cryptography is involved. But with a lot of math, an attacker can "infer some bits of the crypto secret," Ptacek adds.

There hasn't been much activity in VM bug disclosures as yet, but that will change as more apps use virtualization, he says, and then attackers will have fresh vulnerabilities to prey upon as well.

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches "don't cope with well," says Kevin Leahy, director of virtualization at IBM. "As you move virtual resources around, it adds another layer or dimension of complexity to it. You want to ensure that all security policies, access privileges, etc., that you put on the box originally will also be true with the new 'box' you put it on."

VMWare's Lin agrees that security should be part of the virtualization design. Aside from Ace, VMWare offers a virtual Layer 2 switch in its ESX Server -- a hypervisor -- with VLAN support, and the VMWare software lets you lock down virtual network adapters "from running in promiscuous mode," he says. VMWare also offers resource management and the ability to set user permissions.

"We built VMWare Infrastructure 3 architecture as secure as we can make it," Lin says. "But you also need to follow best practices in virtualization."

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • IBM Corp. (NYSE: IBM)
  • Matasano Security LLC
  • VMware Inc. (NYSE: VMW) Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Oldest First  |  Newest First  |  Threaded View
    Why Cyber-Risk Is a C-Suite Issue
    Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
    DevSecOps: The Answer to the Cloud Security Skills Gap
    Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
    Attackers' Costs Increasing as Businesses Focus on Security
    Robert Lemos, Contributing Writer,  11/15/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-19071
    PUBLISHED: 2019-11-18
    A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
    CVE-2019-19072
    PUBLISHED: 2019-11-18
    A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
    CVE-2019-19073
    PUBLISHED: 2019-11-18
    Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, ...
    CVE-2019-19074
    PUBLISHED: 2019-11-18
    A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
    CVE-2019-19075
    PUBLISHED: 2019-11-18
    A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.