CH08 Virtualization

Question 1

What are some of the VM Types ?

Answer 1

▪ System Virtual Machine - Complete platform designed to replace an entire physical
computer and includes a full desktop/server operating system

▪ Processor Virtual Machine - Designed to only run a single process or application like a virtualized web browser or a simple web server

Question 2

What is a Hypervisor ?

Answer 2

Manages the distribution of the physical resources of a host machine (server) to the virtual machines being run (guests)

Type 1 Hypervisor – bare metal, native. It runs directly on the host hardware and functions as a type of operating system. (Example : Microsoft’s Hyper-V, Citrix’s Xenserver, and VMWare’s ESXi and vSphere)

Guest VM, Guest VM
Hypervisor
Physical Hardware.

Type 2 Hypervisor – runs from within a normal operating system like Windows, Mac, or Linux (Example : VirtualBox, VMWare)

Guest VM, Guest VM
Hypervisor
Host Operating Systems
Physical Hardware

Type 1 is faster and more efficient than a Type 2.

Question 3

What is Application Containerization ?

Answer 3

● A single operating system kernel is shared across multiple virtual machines but each virtual machine receives its own user space for programs and data
● Containerization allows for rapid and efficient deployment of distributed application

Example : Docker, Parallels Virtuozzo, Open VZ

Question 4

What is VM Escape ?

Answer 4

▪ An attack that allows an attacker to break out of a normally isolated VM by interacting directly with the hypervisor. In this position, the attacker could migrate themselves out, and into another virtual machine being hosted on the same physical server.

To mitigate this vulnerability, virtual servers should be hosted on the same physical server as other virtual machines in the same network or network segment based on its classification.

Containers share a single common operating system. If the attacker’s able to exploit that one operating system through some vulnerability, this causes all of those applications being hosted by that operating system to be at risk.

Question 5

What is Data Remnants ?

Answer 5

Contents of a virtual machine that exist as deleted files on a cloud-based server after deprovisioning of a virtual machine.

Question 6

What is Privilege Elevation ?

Answer 6

Occurs when a user is able to grant themselves the ability to run functions as a higher-level user

Question 7

What is Live migration ?

Answer 7

occurs when a VM is moved from one physical server to another
over the network.

If an attacker can gain a foothold on your network and place themselves between these two physical machines, they can implement a form of a main in the middle attack where they can capture the data being sent between the two physical servers. Be sure to encrypt the data.

Question 8

What is Virtualization Sprawl ?

Answer 8

Occurs when virtual machines are created, used, and deployed without proper management or oversight by the system admins