Virtualization Vulnerabilities - CompTIA Security+ SY0-701 - 2.3 — Transcript

Full transcript

1. 0:02with today's cloud-based infrastructures
2. 0:04we can build virtual machines at a
3. 0:05moment's notice and we can build many
4. 0:08virtual machines simultaneously if
5. 0:10you've ever managed a laptop computer or
6. 0:12a desktop computer you know what the
7. 0:15security concerns might be for a device
8. 0:17like this but if you're managing a cloud
9. 0:19you may have situations where virtual
10. 0:21machines are constantly created and torn
11. 0:23down during a normal workday this makes
12. 0:26it more challenging to manage the
13. 0:27security posture of these virtual
14. 0:30devices consider also that these virtual
15. 0:32machines may all be built with different
16. 0:35configurations these virtual machines
17. 0:37might all have a different number of
18. 0:38CPUs operational and those CPUs may have
19. 0:41different capabilities they might have a
20. 0:43different amount of memory or different
21. 0:45amount of storage and each one of these
22. 0:47systems may be slightly different in how
23. 0:49it operates and of course these virtual
24. 0:51machines do have aspects of the VMS that
25. 0:54are very similar to os's you may be
26. 0:56running with other physical devices so
27. 0:59the VM M does run a version of an
28. 1:01operating system such as Windows or
29. 1:03Linux and you should be applying the
30. 1:05same type of security best practices to
31. 1:07your virtual machine as you have to your
32. 1:09physical devices but there are some
33. 1:12security vulnerabilities that are
34. 1:13specific to the virtual world
35. 1:15vulnerabilities such as a local
36. 1:17privilege escalation command injection
37. 1:19information disclosure and others can
38. 1:22still be found in these virtual
39. 1:24environments if you've ever used a VM
40. 1:27you know that that VM is its own
41. 1:29self-contained system with its own CPU
42. 1:32memory storage and other resources and
43. 1:34it's not possible to somehow move from
44. 1:37inside one virtual machine on a
45. 1:39hypervisor to things that may be on a
46. 1:42different virtual machine on that same
47. 1:44hypervisor however there have been
48. 1:46instances where researchers have found
49. 1:48ways to jump between these VMS this is
50. 1:51called a VM escape and it allows the
51. 1:53attacker to get access to one virtual
52. 1:56machine and then somehow find their way
53. 1:58to connect to other virtual machines on
54. 2:01that same hypervisor some hypervisors
55. 2:04may manage tens or even hundreds of
56. 2:06different virtual machines which means
57. 2:08if you can escape from one VM and move
58. 2:11to another VM on that same hypervisor
59. 2:13you would have a great deal of data that
60. 2:15you would be able to access this would
61. 2:18obviously be an enormous exploit that
62. 2:20would allow an attacker to gain access
63. 2:22to many systems simultaneously and all
64. 2:25of the data contained within those
65. 2:27systems a practical example of a VM
66. 2:30Escape occurred in March 20177 at the
67. 2:33pwn to own competition this is a hacking
68. 2:35contest where if you can pone the device
69. 2:38then you would be able to physically own
70. 2:40it you get to take that laptop or that
71. 2:42computer with you at the end of the
72. 2:44contest in this competition attackers
73. 2:46were able to use a bug in the JavaScript
74. 2:48engine of Microsoft Edge to gain access
75. 2:51to a Sandbox that's built into the edge
76. 2:54browser from that sandbox they were then
77. 2:56able to exploit a vulnerability within
78. 2:58the Windows 10 in kernel this allowed
79. 3:01them to gain full access to that guest
80. 3:03operating system from there they were
81. 3:05able to take advantage of a hardware
82. 3:07simulation bug within VMware and hop
83. 3:10from one VM to another VM within that
84. 3:13same hypervisor fortunately this
85. 3:16vulnerability was only demonstrated for
86. 3:18the first time during this competition
87. 3:20which allowed VMware to have some time
88. 3:22to create a patch roll out that patch
89. 3:24and make sure that no one else could
90. 3:25take advantage of this VM Escape another
91. 3:29security concern concern for virtual
92. 3:30machines is a resource reuse let's
93. 3:33consider what a hypervisor is doing for
94. 3:35all of the virtual machines connected to
95. 3:37a particular piece of Hardware a
96. 3:39hypervisor is managing this relationship
97. 3:41between the physical world and the
98. 3:43virtual world so the hypervisor is
99. 3:45allocating a certain amount of memory to
100. 3:471 VM a certain amount of storage and a
101. 3:49certain amount of network and CPU access
102. 3:52although the hypervisor is allocating
103. 3:54this amount of resource use for a VM
104. 3:57doesn't mean that that VM has exclusive
105. 4:00access to that particular resource for
106. 4:02example a hypervisor host may have a
107. 4:04total of four physical gigabyt of RAM on
108. 4:07that particular device but that
109. 4:08hypervisor is managing three separate
110. 4:11virtual machines and each of the VMS is
111. 4:13allocated 2 gbt of ram each obviously
112. 4:17the VMS are allocated 6 gabt and we only
113. 4:20have four physical gigabytes available
114. 4:22for the hypervisor we're relying on that
115. 4:24hypervisor to only allocate memory where
116. 4:27it's needed which would allow us to use
117. 4:29effect ively 6 gig of storage space on a
118. 4:32machine that is only equipped with 4 GB
119. 4:35this means at certain times that there
120. 4:36may be certain memory areas that are
121. 4:38shared between different virtual
122. 4:40machines and it's the sharing of
123. 4:42information where we could run into a
124. 4:44problem if the hypervisor has a bug that
125. 4:46doesn't properly allow for the sharing
126. 4:48of resources it is possible that one VM
127. 4:51could write to a memory area and that
128. 4:53memory area could be read by a different
129. 4:55VM normally the hypervisor would be the
130. 4:58component restricted that sharing of
131. 5:00information between VMS in this example
132. 5:03we can see that the hypervisor does have
133. 5:05some type of memory management issue
134. 5:07once that code is updated that
135. 5:09particular sharing would no longer take
136. 5:10place and we can avoid any type of
137. 5:12resource
138. 5:23reuse