4 ms·

Privacy from host is not possible, and you make a very good point about hardware access. Virtual machine are secured by the shared host. I don't really expect

by h0r14 9y ago

Privacy from host is not possible, and you make a very good point about hardware access. Virtual machine are secured by the shared host. I don't really expect top security from this end. A replica backup MX enables me to safely change hosts, if they behave badly. OpenBSD defaults are what I base my endpoint security on, and keeping this updated is super easy.

nickpsecurity 9y ago
"Virtual machine are secured by the shared host. " Virtual machines are not secure in mainstream implementations. The tech they use has had a lot of vulnerabilities in the past. Google and Amazon even have their own custom versions for improving security. There's also no covert/side channel analysis done on those to even know what information leaks will be found in the future. Finally, hardware-level attacks are possible if you have malicious code running that bypass VM protection. Most popular recently is Meltdown/Spectre. There's only been a few VMM's designed for security (two examples below). Most of them probably cost five to six digits to license. The FOSS ones are alpha or beta quality without the tools a big host would want for management. The VMM's focused on rapid development of features in unsafe languages don't look anything like the ones that passed pentesting. They also have highest marketshare due to those features. So, your host serving cheap VPS's is almost certainly not using a secure VMM: they're saving money using an insecure one on insecure hardware that they're patching as vulnerabilities are publicized. Like almost everyone does with their OS's for their beneficial features. ;) http://www.cse.psu.edu/~trj1/papers/ieee-sp-vaxvmm.pdf http://www.cse.psu.edu/~trj1/papers/ieee-sp-vaxvmm.pdf https://ghs.com/products/safety_critical/integrity-do-178b.html https://ghs.com/products/safety_critical/integrity-do-178b.h...

by h0r14 9y ago

nickpsecurity 9y ago

"Virtual machine are secured by the shared host. " Virtual machines are not secure in mainstream implementations. The tech they use has had a lot of vulnerabilities in the past. Google and Amazon even have their own custom versions for improving security. There's also no covert/side channel analysis done on those to even know what information leaks will be found in the future. Finally, hardware-level attacks are possible if you have malicious code running that bypass VM protection. Most popular recently is Meltdown/Spectre. There's only been a few VMM's designed for security (two examples below). Most of them probably cost five to six digits to license. The FOSS ones are alpha or beta quality without the tools a big host would want for management. The VMM's focused on rapid development of features in unsafe languages don't look anything like the ones that passed pentesting. They also have highest marketshare due to those features. So, your host serving cheap VPS's is almost certainly not using a secure VMM: they're saving money using an insecure one on insecure hardware that they're patching as vulnerabilities are publicized. Like almost everyone does with their OS's for their beneficial features. ;) http://www.cse.psu.edu/~trj1/papers/ieee-sp-vaxvmm.pdf http://www.cse.psu.edu/~trj1/papers/ieee-sp-vaxvmm.pdf https://ghs.com/products/safety_critical/integrity-do-178b.html https://ghs.com/products/safety_critical/integrity-do-178b.h...