0% found this document useful (0 votes)

67 views12 pages

Next Generation of Virtualization Technology Part 7 of 8

Next Generation of Virtualization Technology‎ Moodle Team ID : 1054_003 OER Creation S.Ebenezer Juliet , D.Kesavaraja , Chithra Devi & Gayathri Ru Va Computer Science and Allied https://virtualizationweb.wordpress.com/ www.k7cloud.in

Uploaded by

D.KESAVARAJA

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

67 views12 pages

Next Generation of Virtualization Technology Part 7 of 8

Uploaded by

D.KESAVARAJA

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 12

Next Generation of Virtualization

Technology
Part 7 of 8

Moodle Team ID : 1054_003 OER Creation

S.Ebenezer Juliet , D.Kesavaraja , Chithra Devi & Gayathri Ru Va
Computer Science and Allied

https://virtualizationweb.wordpress.com/
www.k7cloud.in

Part 7

Typical Cloud
m m m m m
1 2 3 4 5

m m m m m
1 2 3 4 5

hypervisor

m m m m m
1 2 3 4 5

Cloud
API

hypervisor

hw
m m m m m
1 2 3 4 5

hypervisor

hw
m m m m m
1 2 3 4 5

hypervisor

m m m m m
1 2 3 4 5

hypervisor

m m m m m
1 2 3 4 5

Typical Server Virtualization

Deployment
Win 2003

M
a
n
a
g
e
m
e
n
t

Win 2008

Ubuntu

Redhat

A
p
p

Hypervisor

Hardware

Typical VDI Deployment

desktop

Dom0
OS

Enterprise Hypervisor
Hardware

Thin client

Security Issues
Hypervisor is the underlying component of all these
architectures. It is a new layer which needs to be protected
Scale of deployments Just the sheer scale of deployments
make this a security nightmare. Imagine 150 machines
running a simultaneous scheduled AV scan on the same
physical host. Chokes IO/Disk bandwidth.
Isolation - Machines of a company and its competitor could
be running on the same physical machine. Insufficient
isolation could lead to disaster
New APIs to access Virtualization/Cloud services. Bugs in
these could lead to compromise of entire infrastructure.

Sample Hypervisor Security Issues

CVE-2007-4496, CVE-2007-4497 ESX3.01,
guest operating system can cause buffer
overflow and arbitrary code execution in the
host
CVE-2007-0948 Virtual PC Heap overflow
which could cause arbitrary privilege
escalation
CVE-2007-4993 Xen 3.0.3 User can escape
to domain0 via grub.conf and pygrub

Security Issues Why?

Hypervisors are written by humans. They have bugs
typically buffer overflows
Hypervisor are complex Xen is about 300K source
lines of code
Complete isolation is hard Most systems dont have
IOMMUs which make it possible to DMA to arbitrary
physical memory
Compromised Domain0 on Xen pretty much means a
hosed hypervisor. Domain0 runs commodity OSs
which could have bugs.

Security Issues Why?

DMA is a big problem on non IOMMU based systems:
Xen can setup DMA
Dom0 can setup DMA
Driver domains can setup DMA

The range of physical addresses is not verified

IOMMU based systems can restrict the range of
addresses but they are not present in commodity
hardware
There are some techniques to even bypass IOMMU
checks

Security Solutions
Trusted hypervisor
Hyperguard Phoenix Technologies A hypervisor
integrity scanner in SMM.
Deepwatch Intel project Virtualization rootkit
scanner

Domain 0 Hardening Various security

solutions to white-list and harden Dom0

Security Opportunities
New breed of security products is now
possible to protect guest OSs from being
hijacked
Hypervisor based security suites cannot be
detected by malware running in the guest
Hypervisors allow introspection of very early
boot sequences of the guest, thereby making
possible an entire need breed of BIOS rootkit
and kernel rootkit scanners

Security Opportunities
APIs like VMSAFE from VMWare allow
introspection of interesting system events in
the guests
These events can then be processed on a
dedicated security appliance
These events include CPU state monitoring,
page faults, memory/register accesses, Filesystem events, network events etc.