Access your Pro+ Content below.
Security threats to virtual environments less theoretical, more practical
This article is part of the Information Security magazine issue of September 2009
Jailbreaking a virtual machine has always been sort of a black op. You constantly hear whispers of researchers studying malware samples captured in the wild that can leap from a virtual guest machine to the host. Other researchers, meanwhile, work on exploits for vulnerabilities that would also allow an attacker to escape a virtual machine. These tangible exploits threaten the sanctity of virtualization projects that are so en vogue today with many companies for their server consolidation and power consumption benefits. The volume is getting louder on these exploit tools because every month or so, there are more of them. One of the neatest was outlined in late July at Black Hat 2009 USA. Immunity, an assessment and penetration testing company, provided details on a tool called Cloudburst, developed by senior security researcher Kostya Kortchinsky. Cloudburst, available to users of Immunity's CANVAS testing tool, exploits a bug in the display functions of VMware Workstation 6.5.1 and earlier versions, as well as VMware Player, ...
Access this PRO+ Content for Free!
Features in this issue
For the fourth consecutive year, Information Security readers voted to determine the best security products. A record 1721 voters participated this year, rating products in 17 different categories.
The demonstration of a hacking tool at Black Hat that allows attackers to escape from virtual machines to attack their guest OS elevates the seriousness of security threats to virtualization.
Encryption solves some very straight-forward problems but implementation isn't always easy. We'll explain some of the common misperceptions so you'll understand your options.
Columns in this issue
Accountability for Internet security should be placed on users, not service providers such as hotels.
Security experts Bruce Schneier and Marcus Ranum debate whether perfect access control is possible.
Passing an audit can lull an organization into a false sense of security.