RE: Vulnerability of VMWare Virtual Machine?

It's PROBABLY the worst of both worlds... (and I'm speaking about personal
experiences w/ VMWare and Virtual PC, although I haven't tried to break in).

First off, an attack against a VM is basically a remote attack against
whatever OS that VM is running. If it's a vulnerable one, it's vulnerable -
regardless of whether it's a VM or physical host. Once you are in, you have
all the usual vectors to attack other hosts on that network, local privilege
escalation, whatever...

Where it gets different is that there are additional pieces in play when you
have a VM/Host combination, which might present you with other
opportunities:

(1) Although it's possible to disable all of the network protocols from a
NIC and dedicate it to a VM, you have to remember that the initial
processing is going to go through the host's network stack. So an attack
against the driver or low level network stack - even though it's the VM's
NIC - is really against the host.

(2) Normally, if the NIC is operated in 'bridge' mode, then you have the
usual attack against the host and against the service or driver which
provides the bridge. I'm not aware of any information on how secure that
service/driver is. But if you could cause it to stack overflow, jump
addresses, execute shell code, it's an attack against the host, not the VM.

(3) Assuming you break into the VM, there is SOME communications between the
VM and the host. See http://chitchat.at.infoseek.co.jp/vmware/ for some
information on the (undocumented) communications channel. Whether you could
exploit this to attack the host is unknown.

Given those additional attack points, I think the only safe assumption is
that the VM is less secure (by some unknown amount) than a physical machine
running the same OS would be. And you must realize that there is are some
potential attack points against the HOST also.

So I think prudence dictates that the HOST machine not be a key piece of
domain infrastructure (i.e. not your LDAP or AD server, etc.) and that you
keep all of the VMs up-to-date on security, just as you would for physical
machines subject to attack.


-----Burton



-----Original Message-----
From: Chavoux Luyt [mailto:chavoux@xxxxxxxxx]
Sent: Thursday, March 23, 2006 9:15 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Vulnerability of VMWare Virtual Machine?

Hi

I'm fairly new to virtual machines and would like to know more about their
vulnerability after reading the recent thread on creating an isolated
virtual LAN with 2 virtual machines. I'm using a VMware virtual machine
running WindowsXP SP2(as guest OS) on linux (host OS) for development. I can
connect to the virtual machine (shared folders) from the linux host using
konqueror & samba. I cannot access the linux host from the Windows virtual
machine, but I can connect to the internet and to the other (Windows) PC's
on the LAN (using their IP adresses). I have not bothered to join the domain
from the virtual machine nor installed the anti-virus/firewall software
running on all the other PC's on the LAN. I only use the virtual network
connection to copy data to and from the linux host.

I have two questions regarding the security risk of this setup...
1. The virtual machine is on a different (virtual) subnetwork to the rest of
the LAN... how vulnerable is it to attacks from the internet?
I.e. is it more vulnerable than the other Windows machines on the LAN that
have updated virus scanners and firewalls? (The whole LAN is behind a
firewall as well).
2. If the virtual machine itself get compromised, it is not such a big
problem. However, how vulnerable would the other windows machines on the LAN
be to attacks from a compromised virtual machine? Basically, if I'm not
worried about the data on the virtual machine, should I bother to make it
secure?

Thanks
Chavoux

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich
University program offers unparalleled Infosec management education and the
case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • dsniff wireless arpspoof under SusE VMWare
    ... I am attempting to simulate a middle-man attack with dsniff running on ... a SuSE VMWare virtual machine on an XP host. ... card rather then the MAC address of the SuSE virtual machine. ...
    (comp.os.linux.networking)
  • RE: More on VMWare poor guest isolation design
    ... especially if you are not a full administrator on the host machine. ... should be able to protect a virtual guest from its host. ... explicitly allow a worm to access the RAM or disk of a virtual machine. ... lot more dangerous than a slightly harder indirect attack method. ...
    (Bugtraq)
  • [NEWS] IGMP Denial of Service Vulnerability
    ... We consider different scenarios in which such an attack can be launched. ... Host H1 and H2 are connected to a router R using a hub. ... soliciting for membership reports from the hosts in the network it is ... now R doesn't receive any membership reports for the group ...
    (Securiteam)
  • Re: New Machine on Network Cant See Other Machines Files
    ... Thanks very much for those links and your other assistance. ... the problem (before using the XP Network Problem Solver). ... I am configuring the new machine as a Virtual PC host, ... eventually a second virtual machine) running under that host copy of XP. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Target based IDS review and discussion in Information Security
    ... > 1) A URL attack is seen by the sensor affecting Windows IIS. ... > each and every step we took to investigate the attack (from IDS ... > impacted host to manually verify if the attack was successful or not. ... Automated forensics are useful and a nice step forward but if the ...
    (Focus-IDS)