Security Issues In Hardware Virtualization

Seminar paper from the year 2020 in the subject Computer Science - IT-Security, grade: 1,3, Technical University of Munich (Department of Informatics), course: Seminar Securing the Linux Kernel - Features and Attack Vectors, language: English, abstract: Hardware virtualization is the core concept behind the huge success of cloud computing in the last years. Effective isolation among different virtual machines running on the same host is promised, as well as isolation from the operating system that might be present on the host itself. These barriers are necessary, as cloud computing may create a situation where both provider and customer do not trust each other: The provider wants to keep full control over their expensive server hardware and the customer may want to process sensitive data inside their virtual machine that neither the provider nor other customers are allowed to see. As such, there are several attacker models to be considered in this context, both customers and hosting providers wanting to take control over other virtual machines or the physical server itself. In this paper, we consider attacks for each of the attacker models, as well as possible mitigations. In the end, we will find that while preventing VM escapes only really depends on having secure hypervisor implementations, efforts to protect the VM from the host itself are still rather flawed.

One of the biggest buzzwords in the IT industry for the past few years, virtualization has matured into a practical requirement for many best-practice business scenarios, becoming an invaluable tool for security professionals at companies of every size. In addition to saving time and other resources, virtualization affords unprecedented means for intrusion and malware detection, prevention, recovery, and analysis. Taking a practical approach in a growing market underserved by books, this hands-on title is the first to combine in one place the most important and sought-after uses of virtualization for enhanced security, including sandboxing, disaster recovery and high availability, forensic analysis, and honeypotting. Already gaining buzz and traction in actual usage at an impressive rate, Gartner research indicates that virtualization will be the most significant trend in IT infrastructure and operations over the next four years. A recent report by IT research firm IDC predicts the virtualization services market will grow from $5.5 billion in 2006 to $11.7 billion in 2011. With this growth in adoption, becoming increasingly common even for small and midsize businesses, security is becoming a much more serious concern, both in terms of how to secure virtualization and how virtualization can serve critical security objectives. Titles exist and are on the way to fill the need for securing virtualization, but security professionals do not yet have a book outlining the many security applications of virtualization that will become increasingly important in their job requirements. This book is the first to fill that need, covering tactics such as isolating a virtual environment on the desktop for application testing, creating virtualized storage solutions for immediate disaster recovery and high availability across a network, migrating physical systems to virtual systems for analysis, and creating complete virtual systems to entice hackers and expose potential threats to actual production systems. About the Technologies A sandbox is an isolated environment created to run and test applications that might be a security risk. Recovering a compromised system is as easy as restarting the virtual machine to revert to the point before failure. Employing virtualization on actual production systems, rather than just test environments, yields similar benefits for disaster recovery and high availability. While traditional disaster recovery methods require time-consuming reinstallation of the operating system and applications before restoring data, backing up to a virtual machine makes the recovery process much easier, faster, and efficient. The virtual machine can be restored to same physical machine or an entirely different machine if the original machine has experienced irreparable hardware failure. Decreased downtime translates into higher availability of the system and increased productivity in the enterprise. Virtualization has been used for years in the field of forensic analysis, but new tools, techniques, and automation capabilities are making it an increasingly important tool. By means of virtualization, an investigator can create an exact working copy of a physical computer on another machine, including hidden or encrypted partitions, without altering any data, allowing complete access for analysis. The investigator can also take a live ?snapshot? to review or freeze the target computer at any point in time, before an attacker has a chance to cover his tracks or inflict further damage.

This book focuses on the core question of the necessary architectural support provided by hardware to efficiently run virtual machines, and of the corresponding design of the hypervisors that run them. Virtualization is still possible when the instruction set architecture lacks such support, but the hypervisor remains more complex and must rely on additional techniques. Despite the focus on architectural support in current architectures, some historical perspective is necessary to appropriately frame the problem. The first half of the book provides the historical perspective of the theoretical framework developed four decades ago by Popek and Goldberg. It also describes earlier systems that enabled virtualization despite the lack of architectural support in hardware. As is often the case, theory defines a necessary—but not sufficient—set of features, and modern architectures are the result of the combination of the theoretical framework with insights derived from practical systems. The second half of the book describes state-of-the-art support for virtualization in both x86-64 and ARM processors. This book includes an in-depth description of the CPU, memory, and I/O virtualization of these two processor architectures, as well as case studies on the Linux/KVM, VMware, and Xen hypervisors. It concludes with a performance comparison of virtualization on current-generation x86- and ARM-based systems across multiple hypervisors.

Individual users and business organizations are shifting their data storage and utilizing cloud computing because of its easy availability and reduced costs. Although, this technology is creating an easy way to store, share, and access data, serious security concerns have been generated. Critical Research on Scalability and Security Issues in Virtual Cloud Environments is a critical scholarly resource that examines the concept of cloud computing and explores the various shortcomings of using the cloud. Featuring coverage on a broad range of topics such as cloud architecture for scalability, data vulnerability, and server virtualization management, this book is geared towards academicians, practitioners, and researchers seeking current research on developing effective security measures for cloud paradigm.

This book constitutes the refereed proceedings of the Second International Conference on Security in Computer Networks and Distributed Systems, SNDS 2014, held in Trivandrum, India, in March 2014. The 32 revised full papers presented together with 9 short papers and 8 workshop papers were carefully reviewed and selected from 129 submissions. The papers are organized in topical sections on security and privacy in networked systems; multimedia security; cryptosystems, algorithms, primitives; system and network security; short papers. The workshop papers were presented at the following workshops: Second International Workshop on Security in Self-Organising Networks (Self Net 2014); Workshop on Multidisciplinary Perspectives in Cryptology and Information Security (CIS 2014); Second International Workshop on Trust and Privacy in Cyberspace (Cyber Trust 2014).

The software and networking industry is experiencing a rapid development and deployment of Network Functions Visualization (NFV) technology, in both enterprise and cloud data center networks. One of the primary reasons for this technological trend is that NFV has the capability to reduce CAPEX and OPEX, whilst increasing networking service efficiency, performance, agility, scalability, and resource utilization. Despite such well-recognized benefits, security remains a major concern of network service providers and seriously impedes the further expansion of NFV. This book is therefore dedicated to investigating and exploring the potential security issues of NFV. It contains three major elements: a thorough overview of the NFV framework and architecture, a comprehensive threat analysis aiming to establish a layer-specific threat taxonomy for NFV enabled networking services, and a series of comparative studies of security best practices in traditional networking scenarios and in NFV, ultimately leading to a set of recommendations on security countermeasures in NFV. This book is primarily intended for engineers, engineering students and researchers and those with an interest in the field of networks and telecommunications (architectures, protocols, services) in general, and particularly software-defined network (SDN) and network functions virtualization (NFV)-based security services. Extensively studies security issues in NFV Presents a basis or guideline for both academia researchers and industry practitioners to work together to achieve secure and dependable lifecycle management of NFV based network services

The purpose of SP 800-125 is to discuss the security concerns associated with full virtualization technologies for server and desktop virtualization, and to provide recommendations for addressing these concerns. Full virtualization technologies run one or more operating systems and their applications on top of virtual hardware. Full virtualization is used for operational efficiency, such as in cloud computing, and for allowing users to run applications for multiple operating systems on a single computer.

It is essential for an organization to know before involving themselves in cloud computing and big data, what are the key security requirements for applications and data processing. Big data and cloud computing are integrated together in practice. Cloud computing offers massive storage, high computation power, and distributed capability to support processing of big data. In such an integrated environment the security and privacy concerns involved in both technologies become combined. This book discusses these security and privacy issues in detail and provides necessary insights into cloud computing and big data integration. It will be useful in enhancing the body of knowledge concerning innovative technologies offered by the research community in the area of cloud computing and big data. Readers can get a better understanding of the basics of cloud computing, big data, and security mitigation techniques to deal with current challenges as well as future research opportunities.