Measuring Hypervisor Footprints: Assessing Risk

Transcription

1 Measuring Hypervisor Footprints: Assessing Risk Edward L. Haletky The Virtualization Practice, LLC Author of: VMware vsphere TM and Virtual Infrastructure Security: Securing the Virtual Environment

2 Assessing, Securing, and Hardening the Hypervisor is difficult at best, since the hypervisor is hidden from view. We will discuss what can be secured within the hypervisor, what should be audited, and how the entire virtual environment impacts the security of the hypervisor.

3 The Virtual Environment is ANYTHING that directly or indirectly touches the virtualization host or virtual machines! What is the Virtual Environment?

4 A Picture of the Cloud 40,000 VMs, 512 Blades, 16 TBs Memory?, 48 TBs Disk?

5 Existing Threat Vectors Network Attacks Existing Threat Vectors Worms Trojans Virus Spam DDoS New Threat Vectors The Virtual Environment

6 Virtual Environment Management Network Hypervisor Virtual Machine Virtualization Security Tripod

7 Security Infrastructure Leg

8 Hypervisor schedules VMs on each physical Core/CPU/Hyperthread Hypervisor Controls CPU Complete control on how Cores are assigned to vcpus CPU will be used for hypervisor, virtual switches, etc. Understand Hypervisor Security: Access to CPU

9 Memory Assignment vmkernel Memory VM Memory Page Ptr Memory Ballooning - ESX Page Memory Swapping VM Memory Page Ptr Content Based Page Sharing - ESX.vswp Compare Understand Hypervisor Security: Access to Memory

10 MAC Flooding 802.1q and ISL Tagging Attacks Double Encapsulation Attacks Multicast Brute Force Attacks Spanning Tree Attacks PG-100 X L2-Switch PG-200 X X CAM Random Frame Attacks Understanding Hypervisor Security: ESX Network Protections

11 ARP Cache Poisoning still possible Any Vulnerabilities in Replacement vswitch ESX vswitch/portgroup Protections - Reject MAC Spoofing by GuestOS ESX vswitch/portgroup Protections - Reject Promiscuous Mode vnics within GuestOS ESX vswitch/portgroup Protections - Reject Forged TX from GuestOS XX L2-Switch X CAM VMDirectPath Understanding Hypervisor Security: ESX Network Protections

12 VMsafe Introspection APIs A View into the Hypervisor

13 Type2 Hypervisor Type1 Hypervisor Bridge Host FW L2-Switch Understanding Hypervisor Security: Escape The VM: Type 1 vs Type 2

14 VMware ESX Hypervisor VMware ESXi Type1 Hypervisor SC L2-Switch L2-Switch Posix Shell Understanding Hypervisor Security: Escape the VM: ESX vs ESXi

15 VMware ESX Hypervisor Hyper-V/XenServer Type1 Hypervisor SC L2-Switch Dom-0 Bridge Understanding Hypervisor Security: Escape the VM: ESX vs Xen/Hyper-V

16 VMware ESX Type1 Hypervisor Hyper-V/XenServer Type1 Hypervisor SC FWX X X X L2-Switch X Dom-0 FW Bridge Differences: VMware Type1 vs Citrix Type1

17 Virtualization Security Management Leg

18 Client to vcenter Client to Host Management Tool to vcenter Management Tool to ESX ESX webaccess vcenter webaccess VCB (Backup) Virtualization Security Threat: Data Connections

19 Virtualization Security Network Leg

20 iscsi MiTM NFS MiTM Layer-2 Attacks ARP Cache Poisoning VM App Attacks VMotion Attacks All Other Network Attacks Virtualization Security Threat: Network Leg

21 Hypervisor Footprints are Growing with Introspection and other APIs Virtualization Security starts with understanding the Hypervisor Introspection APIs provide a view inside the hypervisor and increased risk Management Access is the critical Factor Why break the hypervisor when the network is the key component? Secure the Network, Secure Management, and Secure the Hypervisor Future Considerations: Forensics in the virtual environment? 40,000 VMs always in motion Compliancy needs to catch up with Virtualization Use cases or Authoritative Data for security is still evolving Questions?