4 ms·

i may be misunderstanding (there seem to have been at least two famous hacks on linode), but why would you use the word "hypervisor" to explain that someone had

i may be misunderstanding (there seem to have been at least two famous hacks on linode), but why would you use the word "hypervisor" to explain that someone had hacked your host's admin account? isn't the presence of that word (the h word) what makes this (potentially) scary? also, will htp ever come back from exile? (not that it seems too unhappy where it is).

wmf 13y ago
There have been pretty much no hypervisor exploits seen in the wild but plenty of admin hacks. (This is basically the same as Andrew Hay's argument.) I want to give the OpenSSL people the benefit of the doubt when they say they saw Bigfoot, but... are they experts in virtualization? Or are they using loose terminology (e.g. considering dom0 or vCenter to be the "hypervisor")? (HTP is stuck in the scarcity trap, so I should probably block off a weekend to work on it.)
- res0nat0r 13y ago
  Here is a pretty big one from 2012 that was discovered by Rafal Wojtczuk: http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_... It didn't get a huge press release and media coverage but it was a pretty big deal. Probably because there weren't any 0day exploits floating around at the time so this flew under the radar of the mainstream. http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/ http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-pr... http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0... http://invisiblethingslab.com/itl/About.html http://invisiblethingslab.com/itl/About.html
- andrewcooke 13y ago
  looks like you were right - http://www.informationweek.com/security/vulnerabilities-and-threats/openssl-says-breach-did-not-involve-corrupted-hypervisor/d/d-id/1113308 http://www.informationweek.com/security/vulnerabilities-and-... https://news.ycombinator.com/item?id=7009529 https://news.ycombinator.com/item?id=7009529

wmf 13y ago

There have been pretty much no hypervisor exploits seen in the wild but plenty of admin hacks. (This is basically the same as Andrew Hay's argument.) I want to give the OpenSSL people the benefit of the doubt when they say they saw Bigfoot, but... are they experts in virtualization? Or are they using loose terminology (e.g. considering dom0 or vCenter to be the "hypervisor")? (HTP is stuck in the scarcity trap, so I should probably block off a weekend to work on it.)

res0nat0r 13y ago
Here is a pretty big one from 2012 that was discovered by Rafal Wojtczuk: http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_... It didn't get a huge press release and media coverage but it was a pretty big deal. Probably because there weren't any 0day exploits floating around at the time so this flew under the radar of the mainstream. http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/ http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-pr... http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0... http://invisiblethingslab.com/itl/About.html http://invisiblethingslab.com/itl/About.html
andrewcooke 13y ago
looks like you were right - http://www.informationweek.com/security/vulnerabilities-and-threats/openssl-says-breach-did-not-involve-corrupted-hypervisor/d/d-id/1113308 http://www.informationweek.com/security/vulnerabilities-and-... https://news.ycombinator.com/item?id=7009529 https://news.ycombinator.com/item?id=7009529