Instructor: In this lesson,
we're going to discuss virtual machine attacks
including VM escapes, VM hopping, sandbox escapes,
and other VM concerns.
First we have VM escapes or virtual machine escapes.
A VM escape is a type of attack
where a threat actor attempts to get
out of an isolated virtual machine
and then send commands directly
to the underlying hypervisor.
Because each virtual machine is supposed to be isolated,
performing a VM escape should
be very difficult to accomplish.
After all, each guest operating system
shouldn't even know itself
that it's part of a virtual machine,
because it still thinks it has full access
to the emulated physical machine
that the hypervisor is providing.
For a VM escape to be effective,
the attacker has to find a way to directly interface
with the underlying physical resources,
such as the physical server's memory,
hard drive, or processing.
This usually occurs by exploiting a vulnerability
in the hypervisor's code itself.
There have been a few instances
of this occurring and patches have been developed
and released by manufacturers as soon as they discovered
these vulnerabilities.
VM escape is easier to perform on a type two hypervisor
than it is on a type one hypervisor.
If you're using a type two or post-it hypervisor,
the attacker might be able to gain access
to the underlying operating system
that's actually hosting your virtual machines.
If they can, they can then be able
to escalate their privileges
and access other virtual machines being hosted
on that same device and in effect,
create a virtual machine escape.
To prevent a virtual machine escape,
it's always important to ensure
that your guest operating system, your host operating system
and your hypervisor all remain patched and up to date.
Second we have VM hopping or virtual machine hopping.
Now VM hopping is a type of attack
where the threat actor attempts to move
from one virtual machine to another on the same host.
A VM hopping attack is going to focus on exploiting
the hypervisor of the virtualization software
or some kind of a feature to move between the two
supposedly isolated virtual machines.
Now VM hopping sounds similar to a VM escape,
but there is one key difference
that VM hopping is now focused on moving
between one virtual machine to the other.
Whereas when we talked about VM escape,
it's focused on reaching the underlying hypervisor
or host operating system.
To protect against VM hopping
you should always ensure your hypervisor
is up to date and properly patched.
Also, you need to ensure your guest operating systems
and the hypervisor are securely configured
using a best practice configuration guide
to ensure there is no erroneous connections
between the virtual machines that should have been isolated.
Third, we have a sandbox escape.
Now a sandbox is a security mechanism
that's used to separate running processes
and programs in an effort to mitigate system failures
or software vulnerabilities from spreading.
Most commonly, sandboxes are created using virtual machines
or containerization.
Web browsers for example, are commonly using the concept
of sandboxing to separate running web code
from the protected operating system
or other software on the system.
Now a sandbox escape will occur
when an attacker is able
to circumvent the sandbox protections
in order to gain access to the protected operating system
for other privileged processes.
To protect your systems from a sandbox escape,
it is important to ensure your software
and operating systems remain patched and up to date,
as well as ensuring
that you have strong endpoint protection software installed
on your client and that you limit the extensions or add-ons
that are installed inside your web browsers
in the case of protecting
against web browser sandbox escapes.
Fourth, we have a few concerns that we need to talk about
as well when we think about virtual machines
and virtualized environments.
This includes things like migrations and data remnants.
Now, one of the major benefits
of using a virtual environment
is that you can migrate a virtual machine
from one host to another, even while it's running.
This is called a live migration.
Now this migration occurs over the network.
So it's important to always ensure
that the migration only occurs over a trusted network
or one that utilizes proper encryption
between the server setting the virtual machine
and the server receiving that virtual machine.
If the live migration occurs
over an unencrypted connection though,
there's going to be a possibility that the data contained
within that virtual machine could be exposed to prying eyes
or have its integrity compromised by an attacker
using an on path attack.
To prevent this, virtual machine images
should be encrypted prior to being sent
from one server to another over the network.
Remember, servers are no longer just physical devices
located inside of our data centers
but they're also virtual machines that are simply
a file located on some kind of a file system.
And these files can be stolen by an attacker.
Another major concern when utilizing virtual machines
in a cloud environment is data remnants
that could be left over
when you deprovision excess virtual servers.
Many cloud providers utilize block storage
that could allow data that is no longer needed
to be left behind on their storage devices.
If it's not properly erased, that data may be accessed
by unauthorized users.
To mitigate this threat of data remnants,
you should always encrypt your virtual machine
storage locations and ensure
the encryption key is destroyed
whenever the virtual machine is no longer needed
and becomes deprovisioned.
The last thing we need to cover
in terms of security is VM sprawl,
also known as virtual machine sprawl.
Now virtual machine sprawl is the uncontrolled deployment
of one or more virtual machines.
This is a huge area of vulnerability
for you as an organization,
because you have these rogue VMs
that are being installed
without authorization all over your network.
Now this means that the system management isn't being done
for those machines, because you don't know they exist.
And because you don't know the exist,
you're not doing the security patching
and the updating and putting on anti-malware solutions
or antivirus to protect those machines.
Because of this, these VMs become very susceptible
to an attack.
And if an attacker can find one of these rogue VMs
that was caused due to VM sprawl,
they're going to be able to go in and attack that
and gain that as a pivot point into the rest of your network
and then try VM escapes or VM hopping
into other areas of your network.
So keep that in mind,
because this VM sprawl is a big problem,
especially if you have lots of contractors
and developers who are working on your network
and they're not part of your normal team,
and they're not following your normal
change control processes.
So once again, in this lesson, we talked about some
of the security requirements you should be thinking about
and some of the vulnerabilities
that can go against those security requirements.
This includes things like VM escapes, VM hopping,
sandbox escapes, and virtual machine sprawl.