Monday

Catching up on virtualization security



Well, I have been hearing more and more about virtualization in the corridors where I walk. Who doesn't or isn't considering it? So I decided to (re-)focus on the topic for the coming weeks. I started last month by watching this video from Defcon: Defcon 15 - T236 Virtualization: Enough Holes to Work Vegas



One of the things that striked me was that automatic transfer of a machine to another (VMotion and others), is sent in clear text !!! This also allow for the compromise of the hypervisor.

Here's a by-line from an article which details the PoC attack/code that Jon Oberheide used to show how, if you don't follow VMware's (and the CIS benchmark) recommendations for securing your VMotion network, you might be susceptible to interception of traffic and bad things since -- as VMware clearly states -- VMotion traffic (and machine state) is sent in the clear.

This was demonstrated at BlackHat DC and here's how the article portrayed it:

Jon Oberheide, a researcher and PhD candidate at the University of Michigan, is releasing a proof-of-concept tool called Xensploit that lets an attacker take over the VM’s hypervisor and applications, and grab sensitive data from the live VMs.

Next, I had a look at this presentation from Joanna at RSA: Security Challenges in Virtualized Environments. It focuses on rootkits so it wasn't really what I was looking for.

Then I continued on to Rational Survivability, the blog of Christofer Hoff. I saw some recent posts from him on virtualization security and made an overview:WAUW !!! Can you believe it. There goes another weekend to read all of this. From my previous readings, I know that he has very good remarks, like that the challenge of Virtualization Security is NOT technical; it's organizational and operational. I totally agree. I see that people are looking at virtualization as a commodity, another product to install to save money (limit hardware servers and power consumption). It isn't that simple. Let's look at some other points by citing Chris's poetry:

When debating the future of secure virtualization
It's wise to reflect on its very creation

Some say poor code is the reason it's here
while others use doubt and (un)certainty's fear

Economically speaking the V-word's a boon
operationally, though, it showed up too soon

Duties, once separate, are now all a-blended
one moat, lots of castles -- the model's up-ended

Competency and skillsets come into play
Who owns the stack? Well, that's hard to say

Can an admin whose mad skillz focus on the OS,
really be trusted to manage this mess?

The virtual sysadmin owns the keys to the kingdom
but it's hard to fix hosts when you can't even ping 'dem!

Operational silos have now become worse
since the virtual admins control all the purse

The network and security wonks try to fudge it
but switches and firewalls just don't get budget

Security, network, storage, and host
if you push the wrong button it all becomes toast

Our current security solutions don't cope
but the dealers keep pushing their VirtSec straight dope

I don't want to come off like a VirtSec despiser,
but to protect our crown jewels it's all HYPErvisor

Don't worry my friends, no need to be scared
your whole infrastructure will be VMware'd

...or Xen'd, or sPath'd or perhaps Hyper-V'd
virtualization, I'm told, will solve everyone's need

Organizational issues are really what matter
there's no real need to make our vendors much fatter

Focus first on improving your present situation
like assessing your risk and host segmentation

Get a grip on the basics and work up from there
don't give into the hype, doubt, confusion or fear

That's it boys and girls till I rhyme once again
Stay happy, stay secure, and now...
A real poet !!! I want to close this topic for now and finish with this post from The Virtual Datacenter: Does Virtualization Always Save You Money? (Hint: NO)
and here is another view on calculating ROI from techtarget.com: Virtualization tools, advice focus on ROI.

Some other resources/blogs to check out and to keep track of:
Related articles:

Posted by Security4all at 5.5.08

Labels: ,

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)