Secure Virtualization Using SELinux (sVirt)

“Before virtualization, we had isolated servers. A cracker
taking over one server meant that he controlled just that server.
The cracker would then have to launch network attacks against other
servers in the environment. System administrators had lots of tools
to defend against network attacks on machines: firewalls, network
traffic analysis tools, intrusion detection tools, etc.

“After virtualization, we have multiple services running on the
same host. If a virtual machine is broken into, the cracker just
needs to break though the hypervisor. If a hypervisor vulnerability
exists, the cracker can take over all of the virtual machines on
the host. He can even write into any virtual host images that are
accessible from the host machine.

“This is very scary stuff. The question is not “if”, but “when”.
Hacker/cracker conventions are already examining hypervisor
vulnerabilities. Crackers have already broken though the xen
hypervisor, as I documented in one of my previous blogs.

Complete
Story