Hacking The Hypervisor

Dan Morrill Expert Author Article Date: 2008-07-31

With all the talk about cloud computing, virtualization, and systems management, this month there are going to be three discussions about hacking the hypervisor that takes us right to the root of cloud computing and virtualization of systems.

Good time to pay attention to the "Xen 0wning Trilogy" at Black hat if you have time, if you don't have time, have your friends who are going grab the presentations, or hope that the presentations show up on The Invisible Things blog right here.

    It's worth noting that we chose Xen as the target not because we think it's insecure and worthless. On the contrary, we believe Xen is the most secure bare-metal hypervisor out there (especially with all the goodies in the upcoming Xen 3.3). Still, we believe that it needs some improvements when it comes to security. We hope that our presentations will help [in] making Xen (and similar hypervisors) more secure. Source: Information Week
While demonstrating exploits is generally a good thing, there are things to be aware of in the cloud computing and cloud security in the future that we will be dealing with. Many exploits have focused on taking over applications to do things that are not generally good. The longer run is that as cloud computing extends into more and more spaces, there are some security issues that people need ot be aware of, and know about counter measures when they are available.

Cloud computing security is something important, as we move into the virtualized environment, with distributed applications that can fire off anywhere in the world or in any data center than can be geographically dispersed, flaws in the command and control software for those environments can be devastating for companies that are relying on those environments to do work.

There is a lot more to come in this security space, and best to start thinking about cloud computing security from the view points of compliancy, code design, hacking the infrastructure, programmatic issues, people issues, and just about every other aspect of information security.

Comments

About the Author:
Dan Morrill runs Techwag, a site all about his views on social media, education, technology, and some of the more interesting things that happen on the internet. He works at CityU of Seattle as the Program Director for the Computer Science, Information Systems and Information Security educational programs.

Hacking The Hypervisor