Threat, Vulnerabilities and Mitigations: Virtualization Vulnerabilities

Question 1

What’s a VM escape?

Answer 1

Attacker executes commands on the host operating system (OS) from inside the VM. An example is https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9.

Question 2

What must the attacker must first gain to get control of VM?

Answer 2

The attacker must first gain control of the VM and then could access the host through shared networks or resources, such as folders or clipboards, or application programming interfaces (APIs):

Hypervisor

Host OS: zero-day and unpatched exploits

Question 3

What are the alternative ways to get control?

Answer 3

Can also attack through a VM management console:

Don’t leave default creds.

Use Allow/Deny listing to block connectivity from any host.

Question 4

What’s resource reuse?

Answer 4

Isolation is important so attackers can’t gain access to VM resources such as:

Memory
- Access to short term memory RAM - Passwords

I/O: Network interfaces and storage controllers
- Can be sniffed via packets

CPU