News Flash: If You Don’t Follow Suggested Security Hardening Guidelines, Bad Things Can Happen…
So, I was at a conference a couple of weeks ago. I sat in on a lot of talks.
Some of them had demos. What amazed me about these demos is that in
many cases, in order for the attacks to work, it was disclosed that the
attack target was configured by a monkey with all defaults enabled and no
security controls in place. "…of course, if you checked this one box, the
exploit doesn’t work…" *gulp*
We’ve observed a lot of interesting PoC attack demonstrations such as those at shows being picked
up by the press and covered in blogs and such. Many of these stories simply ham it up for the
sensational title. Some of the artistic license and innacuracies are just plain recockulous.
That’s right. There’s ridiculous, then there’s recockulous.
Here’s a by-line from an article which details the PoC attack/code that Jon Oberheide used to show
how, if you don’t follow VMware’s (and the CIS benchmark) recommendations for securing your
VMotion network, you might be susceptible to interception of traffic and bad things since — as
VMware clearly states — VMotion traffic (and machine state) is sent in the clear.
This was demonstrated at BlackHat DC and here’s how the article portrayed it:
Jon Oberheide, a researcher and PhD candidate at the
University of Michigan, is releasing a proof-of-concept tool called
Xensploit that lets an attacker take over the VM’s hypervisor and
applications, and grab sensitive data from the live VMs.
Really? Take over the hypervisor, eh? Hmmmm. That sounds super-serious! Oh, the humanity!
However, here’s how the VMTN blog rationally describes the situation in a measured response that does it better than I could:
Recently a researcher published a proof-of-concept called
Xensploit which allows an attacker to view or manipulate a VM undergoing live
migration (i.e. VMware’s VMotion) from one server to
another. This was shown to work with
both VMware’s and Xen’s version of live migration. Although impressive, this work by no means
represents any new security risk in the datacenter. It should be emphasized this proof-of-concept
does NOT “take over the hypervisor” nor present
unencrypted traffic as a vulnerability needing patching, as some news
reports incorrectly assert. Rather, it a
reminder of how an already-compromised network, if left unchecked, could be
used to stage additional severe attacks in any environment, virtual or
Encryption of all data-in-transit is certainly one well-understood mitigation
for man-in-the-middle attacks. But the fact
that plenty of data flows unencrypted within the enterprise – indeed perhaps
the majority of data – suggests that there are other adequate mitigations. Unencrypted VMotion traffic is not a flaw,
but allowing VMotion to occur on a compromised network can be. So this is a good time to re-emphasize hardening best practices for VMware
Infrastructure and what benefit they serve in this scenario.
I’m going to give you one guess as to why this traffic is unencrypted…see if you can guess right in the comments.
Now, I will concede that this sort of thing represents a new risk in the datacenter if you happen to not pay attention to what you’re doing, but I think Jon’s PoC is a great example of substantiating why you should follow both common sense, security hardening recommendations and NOT BELIEVE EVERYTHING YOU READ.
If you don’t stand for something, you’ll fall for anything.