-: Virtualization Vulnerabilities, our next category.
So we talk about Virtualization Vulnerability,
there's a couple of subcategories.
The most dangerous is VM Escape.
We'll talk about that in a second.
We also have Management Interface Access,
Virtual Host Patching, Virtual Guest Issues,
and Virtual Network Issues.
Now if you're not familiar with what virtualization is,
let's talk about that real quick.
It's when you have one physical host
that hosts many virtual hosts, or simulated,
or emulated hosts inside it.
So in the example here on the screen,
you can see that I have one physical server
and than I have a mail server, a configuration server,
a database server, a web server, a file server,
and a proxy server, all built into this one machine,
and all isolated virtually from each other,
and that brings us to VM Escape;
most serious issue of all virtualization issues.
It occurs when an attacker is able to break out
of the victim, the virtual machine guest,
one of those six machines inside,
and reach the host, the physical hardware,
the hypervisor itself,
which is the operating system on the physical host.
In May of 2017, there was a hacking contest that was held,
and there was a contestant who was able to stich together
three different vulnerabilities together
to actually perform a VM escape.
Now this is not a very common technique yet.
It is not very easy to do.
If you want to learn more about it,
you can see the source there on the screen to the article
from Arstechnica, but it was an interesting way
that they pieced together these different vulnerabilities
to be able to break out of the virtual machine,
and get to the hypervisor itself,
and that is a very dangerous thing since
so much of our server infrastructure now is done
with virtualization, especially in the cloud.
The next one we have is our Management Interface Access,
and this is where the interface that controls
all of those virtual machines.
So in the first example, we had six virtual machines
on one host.
You can get to that management access and configure them,
and that it would look something like this vSphere here
from VMware.
This should be highly controlled access.
You should use things like two-factor authentication,
secure tokens, and other things,
to make sure that only administrators can get to this
because this is where you can do a lot of damage
really quickly.
So again, this is a big vulnerability area
that you want to make sure is addressed
and addressed quickly.
The next one we have is Virtual Host Patching.
Now, just like other servers out there and other hosts,
you have to make sure that the operating system
and software is patched,
and a lot of people tend to forget this, because they think,
oh I just have one machine here,
but that one machine is hosting six
virtual operating systems,
all six of those machines have to be patched
through those virtual machines, as well as the host machine.
So you have to make sure that stuff is done,
and the host itself,
which is what holds those six virtual machines,
that's the virtual host patching we're talking about here
that'll prevent the escape from the VM.
Now that brings us into the clients themselves
or the guests,
and all six of them need to be patched as well,
because each of those represents another server
on your network.
You need to ensure that you are remediating
and patching them,
and that your remediation and patch management program
contains a list of all of your VMs
and all of them are reachable by your scan tools,
because if they're not part
of your virtual vulnerability program,
their gonna get missed in the patching
and their gonna get missed,
and vulnerabilities are gonna be there,
and people are gonna attack you and use those against you.
So you gotta make sure your hosts are secure
and your guests are secure.
The next thing we're gonna talk about here
is Virtual Network Issues.
Now, all of these virtual machines
that are sitting on this physical host,
all these guests that are the host,
they have to be able to talk someway, right,
and so these virtual machines also have virtual firewalls,
virtual routers, and virtual switches,
and all of that needs to be considered
as part of the scanning program as well.
If their embedded as part of you virtual machine solution,
like VMware does, you're gonna need appropriate patching
on the VMware solution to be able to prevent attacks.
If they are simulated,
like for instance you're using a simulated Cisco switch
inside of something like GNS3,
well that Cisco switch needs Cisco patches
to be able to be fully immune from those vulnerabilities.
So you gotta keep those in mind
when you're doing your vulnerability management as well,
because with virtualization it does add a complexity,
because it's not stuff that you can reach out and touch.
It's not counting and saying I've got three machines.
You gotta realize that each machine could have,
10, 20, 30, different virtual guests inside of it as well,
and each of those need to be patched too.