4 ms·

Being someone who uses Qubes OS, seeing cracks that allows a virtualised system to break out to the is scary. After all, the entire security model of Qubes OSis

by lokedhs 10y ago

Being someone who uses Qubes OS, seeing cracks that allows a virtualised system to break out to the is scary. After all, the entire security model of Qubes OSis based on the fact that it's not possible to break out from the VM's. I'm really glad these guys valued their reputation higher than the extra money they could have gotten from selling these exploits on the blank market, but this makes me wonder how many such vulnerabilities are available that hasn't been published.

besselheim 10y ago
Indeed, all commonly-used hypervisors have had host escape vulnerabilities reported over the years, including Xen as used in Qubes - see e.g. http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qubes-escape.html http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qu... Of relevance to Edge exploitation, Microsoft are currently working on a Qubes-like sandboxing model for Edge, based on Hyper-V (though it looks like it'll be aimed towards enterprise customers rather than consumer): https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/#YyTRfeRwP6ihvEsb.97 https://blogs.windows.com/msedgedev/2016/09/27/application-g.... Will be interesting to see if that's part of the challenge in Pwn2Own 2018. Somewhat surprisingly, Hyper-V wasn't successfully exploited at this year's contest.
- mobiplayer 10y ago
  Why are you surprised Hyper-V hasn't been exploited? Did it happen in the past? And this is VMware Workstation, not ESXi; which many people on this thread seem to be confusing.
  - mzkfkkfickv 10y ago
    Actually, the bug was in the wmware tools, which may be available on your vm's handled by esxi.
    - mobiplayer 10y ago
      That's not how it works I'm afraid. Otherwise if I installed those VMware tools on my physical computer and exploited them... to where do I escape? Alternate reality? :-)
  - mzkfkkfickv 10y ago
    Actually, the bug was in the wmware tools, which may be available on your vm's handled by esxi.
  - besselheim 10y ago
    This is the first time Hyper-V has been offered as a target in Pwn2Own, but it's had its share of host escape bugs over the years. The latest one was patched in this month's updates, just before the contest.
wfn 10y ago
> seeing cracks that allows a virtualised system to break out to the is scary Hate to break this to you, but it's been shown time and time again that due to how caching and CPU pipelining works in modern processors, any "isolation" including full-on VM which is not "physical isolation" is leaky: https://pdfs.semanticscholar.org/e544/00824814fed2ef52bb84151b2fc04c863e99.pdf https://pdfs.semanticscholar.org/e544/00824814fed2ef52bb8415... (overview of attacks) Here is a particularly nice paper (proper methodology, well-explained intro, etc.) showing one example (a more or less regular cache timing attack, but with actual private info extraction from host, etc.): https://arxiv.org/abs/1702.08719 https://arxiv.org/abs/1702.08719 - these come up several times a year for various VMs, etc.
- edejong 10y ago
  And even physical separation might not be enough due to EM radiation and power usage.
  - jnwatson 10y ago
    Those problems can and have been resolved with appropriate power filters and shielding.
  - jacquesm 10y ago
    It is many orders of magnitude harder to get data from a computer that is in the vicinity than from one VM on the same machine to the host or another VM on that same machine.
    - edejong 10y ago
      I agree, but VM security and exploits also get orders of magnitude more attention. Besides, physical separation does not just apply to the data-center. Consider EM radiation from phones and laptops.
digi_owl 10y ago
The flaw is to think that security can ever be 100% tight. Not ever physical security is organized like that. At best you can design for a certain level of determination of the attacker, and thats it. Any attacker that is more determined will eventually get past. Question is what are you protection against. Your garden variety identity scammer? NSA? Sometimes it feels like _sec has developed NSA myopia.

by lokedhs 10y ago

besselheim 10y ago

Indeed, all commonly-used hypervisors have had host escape vulnerabilities reported over the years, including Xen as used in Qubes - see e.g. http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qubes-escape.html http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qu... Of relevance to Edge exploitation, Microsoft are currently working on a Qubes-like sandboxing model for Edge, based on Hyper-V (though it looks like it'll be aimed towards enterprise customers rather than consumer): https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/#YyTRfeRwP6ihvEsb.97 https://blogs.windows.com/msedgedev/2016/09/27/application-g.... Will be interesting to see if that's part of the challenge in Pwn2Own 2018. Somewhat surprisingly, Hyper-V wasn't successfully exploited at this year's contest.

mobiplayer 10y ago
Why are you surprised Hyper-V hasn't been exploited? Did it happen in the past? And this is VMware Workstation, not ESXi; which many people on this thread seem to be confusing.
- mzkfkkfickv 10y ago
  Actually, the bug was in the wmware tools, which may be available on your vm's handled by esxi.
  - mobiplayer 10y ago
    That's not how it works I'm afraid. Otherwise if I installed those VMware tools on my physical computer and exploited them... to where do I escape? Alternate reality? :-)
- mzkfkkfickv 10y ago
  Actually, the bug was in the wmware tools, which may be available on your vm's handled by esxi.
- besselheim 10y ago
  This is the first time Hyper-V has been offered as a target in Pwn2Own, but it's had its share of host escape bugs over the years. The latest one was patched in this month's updates, just before the contest.

wfn 10y ago

> seeing cracks that allows a virtualised system to break out to the is scary Hate to break this to you, but it's been shown time and time again that due to how caching and CPU pipelining works in modern processors, any "isolation" including full-on VM which is not "physical isolation" is leaky: https://pdfs.semanticscholar.org/e544/00824814fed2ef52bb84151b2fc04c863e99.pdf https://pdfs.semanticscholar.org/e544/00824814fed2ef52bb8415... (overview of attacks) Here is a particularly nice paper (proper methodology, well-explained intro, etc.) showing one example (a more or less regular cache timing attack, but with actual private info extraction from host, etc.): https://arxiv.org/abs/1702.08719 https://arxiv.org/abs/1702.08719 - these come up several times a year for various VMs, etc.

edejong 10y ago
And even physical separation might not be enough due to EM radiation and power usage.
- jnwatson 10y ago
  Those problems can and have been resolved with appropriate power filters and shielding.
- jacquesm 10y ago
  It is many orders of magnitude harder to get data from a computer that is in the vicinity than from one VM on the same machine to the host or another VM on that same machine.
  - edejong 10y ago
    I agree, but VM security and exploits also get orders of magnitude more attention. Besides, physical separation does not just apply to the data-center. Consider EM radiation from phones and laptops.

digi_owl 10y ago

The flaw is to think that security can ever be 100% tight. Not ever physical security is organized like that. At best you can design for a certain level of determination of the attacker, and thats it. Any attacker that is more determined will eventually get past. Question is what are you protection against. Your garden variety identity scammer? NSA? Sometimes it feels like _sec has developed NSA myopia.