Virtualization Concepts Lesson 005: Security Requirements

What are the main things to consider when it comes to virtual machine attacks?

VM Escapes, VM Hopping, Sandbox Escapes, and other VM concerns.

VM Escape

An attack where a threat actor escapes an isolated virtual machine to send commands to the hypervisor.

How can a VM Escape attack be done effectively?

By interacting with the system's underlying memory, hard drive, or processing capability directly.

How does a VM Escape occur?

By exploiting a vulnerability in the hypervisor's source code.

On which type off of hypervisor is a VM escape easier to carry out?

A Type 2 hypervisor.

What do attackers usually do on a system after successfully executing a VM hopping attack?

Gain access to the host OS, escalate permissions and the gain access to other virtual machines.

How does a user prevent being the victim of a VM escape attack?

By keeping the system on both the host and guest OS, as well as the virtualization software patched and up-to-date.

VM Hopping

Type of attack where the threat actor attempts to move from one virtual machine to another on the same host.

How is a VM hopping attack carried out?

By exploiting the hypervisor of the virtualization software.

How does a user prevent being the victim of a VM hopping attack?

By ensuring the hypervisor is up to date and properly patched, and by ensuring the guest OS and the hypervisor are securely configured.

Sandbox Escape

Occurs when an attacker circumvents sandbox protections to access the protected operating system for other privileged processes.

How does a user prevent being a victim of a sandbox escape?

By keeping software and OSs patched and up-to-date, ensuring strong endpoint protection on the client, and limiting add-ons and browser extensions.

Live Migration

Refers to when a VM is sent from one host to another host over a network.

What is important to consider when using live migration for sending and receiving VMs?

To ensure that it is sent over a secure connection and should be encrypted before being sent.

Data Remnants

Files or data left over when deprovisioning excess virtual servers.

What is important to consider when it comes to data remnants left over from a deprovisioned virtual machine?

That leftover data is properly removed and that the drives or drive storage locations used for the virtual machine are encrypted and/or isolated.

Virtual Machine (VM) Sprawl

The uncontrolled deployment of one or more virtual machines.

Why is VM sprawl a substantial security risk?

Because it can lead to unmanaged VMs that aren't patched, updated, secured, or monitored, leaving vulnerabilities in entire systems.

What causes VM sprawl?

People accessing VM systems and not following company protocols for ensuring that VM sprawl doesn't happen.

How is VM sprawl mitigated?

By rolling the proper protocols and documenting everything.