Securing the virtual world

Next month at the annual Black Hat conference in Las Vegas, noted security researcher Joanna Rutkowska plans to demonstrate how a malicious hacker could take control of Xen virtualization software.'With our presentations, we take the game to the next level by studying how to compromise the hypervisor and what we can do to prevent it,' Rutkowska said in an e-mail response to questions. If she makes good on her promise, it will be another chink in the armor of virtualization.Increasingly in the past year, security issues have beset VMware and Xen, the two largest operating system virtualization applications. These programs are not less secure than other enterprise applications ' in fact, security researchers have applauded the code underlying the applications ' but there is an inevitable lag time between when a new application hits the enterprise and when it gets incorporated into the security profile of large organizations.'We see a lot of organizations rolling [virtualization] out first and only later dovetailing it into the security planning,' said Chris Farrow, director of product strategy at Fortisphere, at the recent RSA Conference 2008 in San Francisco. 'The problems of the past come back to bite us in new and different ways.'VMware and Citrix Systems, which offers a commercially supported version of the open-source Xen virtualization software, downplay the severity of the findings by Rutkowska and others, saying that they apply only to development code or peripheral products. Besides, company officials say, if there are holes in virtualization software, they would still be the most difficult ways to enter a network.But researchers say the claims these companies make about the robustness of their software are greatly overstated and could lead users to false complacency.In any case, administrators creating virtualized environments ' especially for security reasons ' should be aware of these issues and make use of tools already available to protect against them.Sci-fi movie lovers might remember the scene in 'The Matrix' in which Neo, played by Keanu Reeves, must choose between the red pill that provides the disturbing though ultimately illuminating truth of his surroundings and the blue pill that maintains the illusion he's living under.The security research community has seized on this idea with regard to virtualization. Red Pill is shorthand for a user being aware that he or she is operating in a virtual environment. As part of the SANS Institute's Security 517 class, 'Cutting- Edge Hacking Techniques,' instructor John Strand outlined security researchers' thinking. When logging on to a computer, they look to see if they are in a virtualized environment, because if they are, they can look for tools installed by the virtualization software in that environment. The tools could have vulnerabilities that could be used to gain admittance to the host machine.The goal for many researchers is to break out of the virtualized container, Strand said. No one has done it yet. But gathering vulnerabilities is the first step.Slowly but surely researchers are finding program errors that can help them penetrate a host. In March, security analyst firm iDefense and VMware disclosed a technique called directory traversal that allows someone using VMware Tools to peek into the host computer via a File➔Open command. VMware issued a patch.Xen hasn't been immune, either. In October, security research firm Secunia showed how a Xen command was not properly checking user input at one point, allowing users to input a malicious command in a string of text. And last month, another researcher found a buffer overflow error in the program's video frame buffer, again allowing for insertion of a malicious command.In 2005, the Homeland Security Department's Homeland Security Advanced Research Projects Agency awarded security research firm Intelguardians a $1.2 million contract to investigate whether VMware, Xen and Microsoft virtualization products could be compromised. Intelguardians found that all three could. Only VMware's ESX Server has thus far been resistant to attack, said Ed Skoudis, Intelguardians' founder and senior security consultant.Virtualization software companies have started looking at ways to allow users to access memory directly to speed response time. Most notably, device manufacturers are starting to add input/output memory management units (IOMMUs) to their products, said Nand Mulchandani, VMware's senior director of product management and marketing. IOMMUs allow virtualized environments to directly access a slice of device memory for their needs while keeping other parts of the memory secure from snooping. In addition, other software-only approaches mimic IOMMUs' mapping techniques.Although all these techniques improved performance and provided adequate security, some setups did not protect virtual environments from misbehaving drivers, said Paul Willmann, at the annual Usenix user conference, where he presented a paper he co-authored on the performance and security trade-offs of IOMMUs.In addition to vulnerabilities, each virtualization program also has unique operational characteristics, which malicious attackers could exploit. At its conference in Boston, Usenix offered a class on securing virtual environments, taught by Phil Cox, a principal consultant at SystemExperts. Cox pointed out some of the more worrisome characteristics of Xen and VMware.For instance, VMware offers the ability to move a virtual machine from one physical server to another on the fly, a feature called VMotion. This could be handy for moving applications to less-busy machines or for moving work off machines that are starting to fail. However, Cox said, users should be aware that when the environment is moved, it is moved in plain text. It is not encrypted. Theoretically, a sniffer between the two machines could easily capture all the content on the virtual machine.Another characteristic of VMware is that the VMware Infrastructure appears to use the Tomcat application server, which serves as the interface to the browser. As a result, it has all the standard settings used by Tomcat ' and could fall prey to all the same vulnerabilities. 'If I had to break ESX, I would go after Tomcat,' Cox said.In April, the Defense Information Systems Agency published the 'ESX Server Security Technical Implementation Guide' and noted a number of other characteristics that could lead to security failures. For instance, the ESX Server only supports one-way Challenge-Handshake Authentication Protocol for iSCSI communication with hard drives ' and does not allow use of more robust alternatives such as Kerberos, IP Security or public-key authentication methods. If virtual switches are used, someone in a virtualized environment could view traffic traveling to an iSCSI device from other virtual machines on the same virtual localarea network.Xen has its own quirky characteristics, Cox said. For instance, the Xen- Center management console has no independent log-in mechanism. Start the software and you will be greeted with 'Press