Security Basics mailing list archives
RE: Vulnerability of VMWare Virtual Machine?
From: "Burton Strauss" <Burton () FelisCatus org>
Date: Fri, 24 Mar 2006 15:01:28 -0600
It's PROBABLY the worst of both worlds... (and I'm speaking about personal experiences w/ VMWare and Virtual PC, although I haven't tried to break in). First off, an attack against a VM is basically a remote attack against whatever OS that VM is running. If it's a vulnerable one, it's vulnerable - regardless of whether it's a VM or physical host. Once you are in, you have all the usual vectors to attack other hosts on that network, local privilege escalation, whatever... Where it gets different is that there are additional pieces in play when you have a VM/Host combination, which might present you with other opportunities: (1) Although it's possible to disable all of the network protocols from a NIC and dedicate it to a VM, you have to remember that the initial processing is going to go through the host's network stack. So an attack against the driver or low level network stack - even though it's the VM's NIC - is really against the host. (2) Normally, if the NIC is operated in 'bridge' mode, then you have the usual attack against the host and against the service or driver which provides the bridge. I'm not aware of any information on how secure that service/driver is. But if you could cause it to stack overflow, jump addresses, execute shell code, it's an attack against the host, not the VM. (3) Assuming you break into the VM, there is SOME communications between the VM and the host. See http://chitchat.at.infoseek.co.jp/vmware/ for some information on the (undocumented) communications channel. Whether you could exploit this to attack the host is unknown. Given those additional attack points, I think the only safe assumption is that the VM is less secure (by some unknown amount) than a physical machine running the same OS would be. And you must realize that there is are some potential attack points against the HOST also. So I think prudence dictates that the HOST machine not be a key piece of domain infrastructure (i.e. not your LDAP or AD server, etc.) and that you keep all of the VMs up-to-date on security, just as you would for physical machines subject to attack. -----Burton -----Original Message----- From: Chavoux Luyt [mailto:chavoux () gmail com] Sent: Thursday, March 23, 2006 9:15 AM To: security-basics () securityfocus com Subject: Vulnerability of VMWare Virtual Machine? Hi I'm fairly new to virtual machines and would like to know more about their vulnerability after reading the recent thread on creating an isolated virtual LAN with 2 virtual machines. I'm using a VMware virtual machine running WindowsXP SP2(as guest OS) on linux (host OS) for development. I can connect to the virtual machine (shared folders) from the linux host using konqueror & samba. I cannot access the linux host from the Windows virtual machine, but I can connect to the internet and to the other (Windows) PC's on the LAN (using their IP adresses). I have not bothered to join the domain from the virtual machine nor installed the anti-virus/firewall software running on all the other PC's on the LAN. I only use the virtual network connection to copy data to and from the linux host. I have two questions regarding the security risk of this setup... 1. The virtual machine is on a different (virtual) subnetwork to the rest of the LAN... how vulnerable is it to attacks from the internet? I.e. is it more vulnerable than the other Windows machines on the LAN that have updated virus scanners and firewalls? (The whole LAN is behind a firewall as well). 2. If the virtual machine itself get compromised, it is not such a big problem. However, how vulnerable would the other windows machines on the LAN be to attacks from a compromised virtual machine? Basically, if I'm not worried about the data on the virtual machine, should I bother to make it secure? Thanks Chavoux --------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus --------------------------------------------------------------------------- --------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Vulnerability of VMWare Virtual Machine? Chavoux Luyt (Mar 24)
- Re: Vulnerability of VMWare Virtual Machine? Gregory Rubin (Mar 27)
- RE: Vulnerability of VMWare Virtual Machine? Burton Strauss (Mar 27)
- RE: Vulnerability of VMWare Virtual Machine? Murad Talukdar (Mar 27)
- Re: Vulnerability of VMWare Virtual Machine? Gregory Rubin (Mar 28)