Common Virtualization and Cloud Vulnerabilities

There are a lot of advantages to virtualizing your environment or putting everything up into the cloud, or probably a combination of both. But they also come with their risks and vulnerabilities. So let's take a look at common vulnerabilities associated with virtualization and the cloud.

What virtualization is

I'm on my desktop right now and it's running Windows, so it is just running one operating system for the one physical machine that I have. The idea behind virtualization is I can suddenly run multiple virtual machines on one piece of hardware.

So what we have right here is the hardware, the machine itself, and we are running many different virtual machines on it. Maybe this first one is Windows, maybe the second one is a version of Linux, maybe the third one is FreeBSD. So we're running many different virtual machines, and the reason that we can do this is we're running some sort of what's called a hypervisor.

The idea behind virtualization is that we virtualize what you would typically see, a machine running on a piece of hardware, but we're virtualizing it now. We can move this around, we can move it from place to place, we can install it with many other machines. There's a lot of advantages to this.

What the cloud is

The cloud in many ways is a different concept. If we have our local machine that's running right here, perhaps we're using some sort of cloud resources — we have stuff up in the cloud. What exactly does that mean? Well, it's in the internet. But why do we call it the cloud? The cloud, because it's a little bit obscure on where exactly it is and how it resides out there. I mean, somebody knows, but it's these companies that are running up in the internet. And so we're not exactly sure where this information is going and where we're storing things and what it's being rammed. So that is the cloud environment.

For many, virtualization and the cloud are very different concepts. Virtualization means we're virtualizing machines, versus the cloud means that we're running stuff up in the cloud.

Why I group them together

So why am I grouping these two things up? To my mind there is an overlap between these.

In my career, we used to install a single service per machine, relatively speaking, but essentially every machine had some sort of operating system on it. At some point in time, we moved to virtualization, where we had many virtual machines running on a bank of hardware, a bank of physical machines. And then there was a transition to the cloud, where we move these machines up into the cloud. So to my mind there's a lot of the same issues when it comes to this virtualization and the cloud. I see a lot of similarities in some of the common vulnerabilities and weaknesses.

The cloud is a spectrum though. When we're running our own machines and virtualization, that looks more like this on premises and low collocation. But we can move those same machines up into the cloud, into some sort of infrastructure as a service, or we can move those services into platform as a service, or we could get rid of the platform altogether and just use software as a service. The intention for me is not to go over what all of these mean — I'll do that in other lessons. But really this is more of a transition, where some of these mimic closely what virtualization does and has the same issues as virtualization, whereas the others towards the end here have their own kind of vulnerabilities and issues that we have to examine.

Common vulnerabilities

Some vulnerabilities that we would see for the cloud are some sort of misconfiguration or poor access management, lack of visibility, insecure APIs, supply chain risks, account hijacking, compliance issues. Really, a lot of these are very similar to what we would see in other software and network vulnerabilities.

When it comes to virtualization vulnerabilities, we see things like VM escape, hypervisor attacks, inadequate isolation, misconfigurations, extra layer of complexity, VM sprawl, and shared resources. Many of which, depending on which cloud resources that you are subscribed to — for instance, infrastructure as a service — you'd see a lot of the same issues in there.

Virtual machine escape

One of the risks that we run is something like a virtual machine escape. These are all shared on the same piece of hardware, so it's more susceptible for one machine to be able to leverage the other machine. This is an issue no matter what environment you have, it is a concern. However, it becomes more of a concern with virtual machines, because now we have this common thread of this hypervisor right here. So one machine could leverage either the hypervisor or the hardware to gain access to another machine, and that's called a virtual machine escape.

Resource reuse

It's also using a lot of the same resources: the CPU, the memory, the storage. Let's use memory as an example. Memory is that short-term storage, the RAM that's inside of a machine, and that's constantly being used by different machines. That's one of the advantages of virtualization, that each of the machines can utilize this RAM, and we can better utilize it, because when one machine's not using it we can repurpose it for another machine.

But therein lies the problem, the resource reuse. For instance, one machine might be using a block or section of this memory, and then when it no longer needs it, it gets rid of it. Now it's available for another machine, and there's potential for that other machine to go in and read that information.

So that's just one of the many examples of risks that we run, or vulnerabilities there are, when we're in the virtualization environment or even in the cloud environment.