3 ms·

You won't hear much about the VM escapes in those clouds because there is strong incentive for almost everyone to be quiet about them and patch as soon as possi

by effie 6y ago

You won't hear much about the VM escapes in those clouds because there is strong incentive for almost everyone to be quiet about them and patch as soon as possible so there "isn't a story". Some researchers do want to make a name for themselves and publish before the patch, but those are minority. And publicly attacking a big corporation is quite risky so they prefer presenting the bug as general problem in the technology. But the bugs in hypervisors exist, see CVE's for Xen for the past decade. See also https://security.stackexchange.com/questions/130274/how-do-big-cloud-providers-guard-against-vm-escape-attacks https://security.stackexchange.com/questions/130274/how-do-b... https://nakedsecurity.sophos.com/2015/05/14/the-venom-virtual-machine-escape-bug-what-you-need-to-know/ https://nakedsecurity.sophos.com/2015/05/14/the-venom-virtua... Regarding L4, I do not know. Probably it is very different and cumbersome to work with compared to linux.

MaxBarraclough 6y ago
> Some researchers do want to make a name for themselves and publish before the patch, but those are minority. And publicly attacking a big corporation is quite risky so they prefer presenting the bug as general problem in the technology. That doesn't sound right to me. The industry norm for security research is 'responsible disclosure', which is intended to give the vendor reasonable time to implement the fix, while eventually publishing the knowledge for all to know. Unless they're simply being paid for their silence, I can't imagine a security researcher wanting to keep quiet about a major achievement like that. > bugs in hypervisors exist, see CVE's for Xen for the past decade Sure, but I'm talking specifically about the big 3 cloud providers, not vanilla Xen. Amazon in particular have gone to pretty extreme lengths with their Nitro system.

by effie 6y ago

MaxBarraclough 6y ago

> Some researchers do want to make a name for themselves and publish before the patch, but those are minority. And publicly attacking a big corporation is quite risky so they prefer presenting the bug as general problem in the technology. That doesn't sound right to me. The industry norm for security research is 'responsible disclosure', which is intended to give the vendor reasonable time to implement the fix, while eventually publishing the knowledge for all to know. Unless they're simply being paid for their silence, I can't imagine a security researcher wanting to keep quiet about a major achievement like that. > bugs in hypervisors exist, see CVE's for Xen for the past decade Sure, but I'm talking specifically about the big 3 cloud providers, not vanilla Xen. Amazon in particular have gone to pretty extreme lengths with their Nitro system.