Posts Tagged ‘Virtualisation’

Virtual Private Servers (vps) – a Guide

December 12th, 2009

 

Web Hosting, if tarred with as broad a brush as possible, is split into Shared and Dedicated Hosting. There are those who purchase a space on a server for their own use, and then there are those who just buy the server. A bit like buying a plane ticket, or buying a plane (except the difference between a return to Oslo and a Cessna are a bit more pronounced).

There is a bridge over these troubled waters, however. It’s known as VPS (Virtual Private Server – it’s also known as VDS, Virtual Dedicated Server, but that’s not as common, presumably because it leads to confusion with old fashioned displays and sounds like something unsavoury you might catch on a night out in Calcutta). VPS allows freedom from the constraints of Shared Hosting, without the expense or expertise of a Dedicated server.

A Shared Hosting server typically has an operating system installed on it, and the host then installs the software they want – they set the server exactly as they like it, and then customers pay them certain amounts of money to purchase a little space on the server. The customer has as much control over that space as the host will let them, and their performance will be based on however many customers are Sharing the server (hundreds, perhaps). Remember that a server is just like your computer at home or at work – and just like your computer, it has a certain amount of memory and a certain speed of processor, and it can only do so many things at once before it has to start putting people in a queue (this is the point where your site may seem slower than usual).

A Dedicated server works the same as a Shared server, except the owner of the server has far more control over what is on their server. Like the hosting company with the Shared server, the owner of the Dedicated can pick the operating system, what software is installed, and how many sites run on the server. If a Dedicated server is set up specifically for one site and is configured for that site alone, that site will run considerably faster than a site on a Shared server. It doesn’t have to share resources and it can be built purely for the purposes of running that site.

VPS sits between these two types of hosting. There are several kinds of VPS, but we will focus on software VPS. In this instance, the host will buy the server, and install an Operating System (OS) on it. They then use another program (i.e. Virtuozzo) to create several isolated Virtual Servers (sometimes known as Containers) on the server. Each of these Containers is a Virtual Server – they function as if they were stand-alone, Dedicated Servers, when in actual fact they are a more advanced form of Shared hosting!

Compared to Shared hosting, VPS has many benefits. To begin with, Shared hosting comes with no performance guarantees. That’s not to say that Shared hosting is slow – it’s just that some sites require a lot more resources than others, and a few busy or intensive sites on a full Shared server could well impact the performance of everyone else (try opening a few basic programs on your computer at once , keep them open, and then see how well your computer runs when you start a virus scan – those basic programs aren’t so responsive now, are they?).

With a VPS, your Container will come with a guaranteed proportion of the server’s resources. This usually comes in the form of RAM (Memory) available – for instance, your VPS might come with a guaranteed 256 or 512 MB of RAM. This means that, regardless of how many people there are on the server, regardless of how busy their sites are, you always, always have that much memory available for you to use. Some companies also advertise the ‘burst’ memory available to you as well. This is essentially the memory that you could conceivably use, assuming that everyone else isn’t using their quota. However ‘burst’ memory is a subjective term – as there are no guarantees on how often this memory will be available to you (beyond the length of a piece of string), it’s more a fancy figure to impress potential customers with.

As a Container is purchased with a guaranteed RAM quota, there will be far fewer customers sharing a VPS server than there would be sharing a, er, Shared server. So the CPU won’t be divided between as many clients and their respective demands on it, so speeds will improve and the load on the CPU will decrease. All in all – your hosting will be noticeably faster. Again, some hosts will advertise CPU preferences, server contention rates etc., to demonstrate how the more expensive VPS packages will take preference to some degree over the cheaper packages when requesting resources from the CPU. How much this makes an impact on your decision to buy that VPS or not is up to you; many hosts don’t make any preferences between packages whatsoever.

The other major benefit to a VPS is the extra control that you will have over your hosting. If you’ve managed to find someone who does hardware VPS, then you’ll be able to pick your own OS as well (hardware VPS, essentially, creates the VPS on a hardware level rather than a software level – the good part; you can do whatever you like with your VPS – the bad part; the hardware, rather than shared, is divided, so instead of having the use of, for instance, a 2gHz processor and a guaranteed 256MB of RAM, you get a .5gHz processor and a guaranteed 256 MB of RAM if 4 people are sharing your server). From here you can configure your hosting as you see fit – customise your PHP settings, install PHP x, Zend whatever, Hardy Heron and/or Peggle (not recommended for a work environment). Even better, as your VPS is essentially a Virtual Machine, you can take snapshots of your entire VPS – so your whole account can be backed up into a single file, and then should something go horribly wrong, you can use the snapshot to restore the VPS in its entirety.

VPS will, of course, cost more than Shared Hosting, but on the flip side of the coin it is considerably cheaper than a Dedicated server. If performance is more of an issue for you than cost then a Dedicated is the way forward – a VPS will never be able to command the amount of resources that a Dedicated server used for the same purpose can. But as a cost-effective solution to providing a significant performance boost to your hosting, as well as allowing yourself a greater degree of control – VPS is hard to fault.

*Please note – I’ve been to Calcutta. I’m not implying that the place is unsavoury, disreputable, or otherwise trying to smear the good name of Calcutta in any way – it just seemed to round the sentence off nicely!

About the Author:

Ewan MacLeod works for NuBlue, a UK based Web Agency that specialises in Web Design and Web Hosting.

I work for NuBlue Web Solutions, providing Web Hosting, Design and Marketing services.
web security

Top 10 Tips for Data Recovery

December 11th, 2009

What would happen to your business if you experienced a catastrophic data loss? Would your business survive? The statistics are alarming, 43% of businesses never re-open after a major disaster. A well planned data recovery strategy can deliver improved resilience with predictable costs and no unscheduled downtime. It will also allow you to sleep at night! Below are some points to consider when compiling your Data Recovery plan.

1. Identify your data recovery needsData Recovery is vital for the survival of your business. Your data defines and separates your business from any other in the market. If failure should occur at any level of your infrastructure it can be felt across the business. You must ask yourself, how would your business survive a disaster? And what provisions do you have in place for your business to continue after?

2. Understand the risksData loss can range from the accidental deletion of files; to the failure of your entire site. Without data recovery precautions in place you are putting your organisation at risk. IT failure is considered to be the most common threat to businesses, with electrical, hardware and software failure also posing considered risks. The threat of fire and natural disaster, although considered less likely can have the most devastating consequences. Findings from a CBI study indicate that a high level of disruptions in 2008 and 2009 were due to extreme weather incidents such as snow, flood or high winds.   

3. Assess how critical your data isThe key aspect of data recovery is understanding just how critical your data is. By compiling an assessment on the risks to your business you can then develop a tiered recovery strategy that will ensure all levels of your infrastructure can be recovered in the event of a disaster. 

4. Assess how easily you can recover a fileData backup is required by all businesses. With legal requirements tightening and data volumes growing out of control, traditional tape backup is no longer a reliable or cost effective means of meeting compliance levels. Managed Online Data Backup Services enable you to instantly recover files within seconds and deduplicate data to make the most of your storage; saving resources and reducing costs. Data is encrypted during the backup process to offer the highest level of security and is ready for recovery if needed.  

5. Consider what the impact of a server failure would beAssessment for data recovery calls for you to consider the maximum amount of downtime you can afford for any system before the impact becomes critical to business operations. You can define your data recovery policy according to how critical that system is, the chance of failure and how much you are willing to spend to minimise recovery time.   

6. Assess how easily you could recover your systemsThe process of re-installing an operating system, its service packs and updates, along with applications and new device drivers can take hours or even days, contributing to your overall recovery time. Prior to the lengthy process of application installation and data restoration, a compatible system is required, adding yet more downtime to that ticking clock. The reality is that system failure could result in over week of downtime till your system is back up and running.   

7. What is the impact of downtime on your company?For most large organisations, to be without a particular system, such as email for any length of time could result in the loss of business. Should the system running your website fail, and customers attempt to visit an inactive site, the chances are they will not return. The longer the site is down, the more business you could potentially lose. It is vital that you can recover your systems as quickly as possible, reducing downtime and limiting loss of business. Essentially, any length of downtime can be harmful to your business, but extended downtime could spell out the end.   

8. Assess what method of system recovery is best suited to your critical systemAssessing the critical levels of your specific data and systems, allows you to set a data recovery policy that works best for you depending on the Recovery Point Objective (RPI) of your data. Bare metal recovery essentially backs up the entire system, enabling you to recover the operating system, application software and data in a single pass, reducing your recovery time by hours. This solution enables you to recover to either similar or dissimilar hardware. Online disk backup allows you to increase the frequency of your backup for more dynamic and rapidly changing data. This Real-time protection solution provides this and, with tiered recovery architecture, you have the flexibility of backing up more frequently on critical systems and less frequently on non-critical systems. This saves you money as it cost-effectively balances your data protection needs. Another method is continuous data protection (CDP), which improves your time to recover a complete system. With CDP, you backup very rapidly across a LAN to your local vault onsite while simultaneously backing up over the wire to a vault in offsite, providing protection from on-site and natural disasters.   

9. Consider how your network would survive a disasterPutting a resilient data recovery policy in place insures your data against failure, but what about your network? Your network infrastructure is vital to continuous running of your organisation. A disaster on site will take out your network as well as your data. Hosting your network with a service provider offers you a fully managed solution for network recovery. Your network will be accessible even in site failure, ensuring that your business continues as normal.   

10. Consider how your telephony would survive a disasterManaged hosting is the ultimate business continuity solution. Not only can you host your data, systems and network safely offsite in the service providers ‘cloud’; you can also protect your telephony systems in the same way. Service providers such as InTechnology offer a portfolio of hosted cloud services to protect your entire infrastructure. Hosting your IT infrastructure in the cloud covers every aspect for business continuity as well as allowing you access to extra computing resources when you need them. For a truly resilient business continuity solution that is flexible with your business needs, managed hosting is the answer.  

What is the real difference between VMware ESXi and VMware ESX?

December 9th, 2009

I dedicate today’s article on emphasizing the differences between VMware ESXi and VMware ESX. As many of you still believe that VMware ESX is better than VMware ESXi, where another team is still wondering if VMware ESXi is better than VMware ESX. As the two products names & functionality is very similar, they can easily get you confused. I don’t think you should ask which one is better, but which one fit me the best. Keep reading to find out how they different & which one is best suitable for your environment.

The first thing you should ask your self: What are the differences between VMware ESXi server & VMware ESX server?

- The first major difference between ESX & ESXi is that ESXi has no service console, which means that you can’t execute any commands on the local console of the machine like its possible with ESX. Please note there is a smaller subset of commands that can be executed against the ESXi remotely using “Remote CLI”, which is sufficient for most users. To be honest if you are an expert in VMware ESX, then you will know there is a very tiny unsupported console on the ESXi which meant to be only used by VMware support.

- As VMware ESXi has no service console, the size of it shrinks dramatically. In addition it will require way less patching than the normal version. Remember the Service console is running a stripped out version of Redhat which will require way more patches than the VMware kernel it self, so by getting rid of that you can save a lot of the time on getting updates.

- VMware ESXi was originally meant to be distribute as a very small image, which get to be preinstalled by your hardware vendor on a small flash memory drive (or solid state drive as in ESXi 3 the size is less than 32MB & in vSphere its less than 100MB in total. Though now VMware ESXi is available to be installed by the user, as long its supported on your particular server by your Hardware vendor.

- Please note the free VMware ESXi server includes the file system and functionality, VMFS, VMware Virtual SMP (symmetric multiprocessing) – which is the ability to configure more than one virtual CPU per VM, but in order to run advanced functionality such as VMotion, DRS, HA, Storage VMotion, FT you will require an additional license. If you need a basic & reliable Virtualization platform then the free ESXi can do the job for you, & when you decide to grow up & you require more advanced features you will only have to acquire the feature license and enable it in ESXi. In the other hand, VMware ESX has no free version offered & you will have to purchase a license to start using it. Please note the minimum license of VMware ESX has plenty more features than what is enabled on the Free ESXi before adding any license to ESXi. Though you always can obtain a license for the VMware ESXi & run all the features supported by VMware ESX without reinstalling anything.

- Please note when you obtain the free VMware ESXi, it will not include any official support till you obtain a license. This means if you are keeping the free VMware ESXi you will have to depend on the community support till you obtain a license which enable many features as said earlier. Its worth mentioning though the VMware community is very helpful.

So again you might be asking yourself when to use VMware ESXi & when to use VMware ESX?

Which one is the right solution for my environment is it VMware ESXi or VMware ESX?

Eiad Al-Aqqad is the founder of VirtualizationTeam.com. Eiad have been delivering Consultation & implementation in the Storage & Virtualization Area for Enterprise customers for over 7 years & always giving back to the community by sharing his knowledge online.
phoenix seo

The Benefits of Cloud Hosting

November 18th, 2009

The term ‘cloud hosting’ has caught the attention of web developers the world over. But while the underlying concepts of cloud technologies date back to the 1960s, and even with the term first coming into commercial use in the 1990s, there is still a great deal of uncertainty revolving around the capabilities and benefits of cloud hosting. Cloud hosting (‘cloud’ being a metaphor for the internet) is a computation or storage service that’s supported by a pool of distributed computing resources. But before attempting to grasp the concept of cloud hosting, it first helps to know a bit about cloud computing. Cloud computing is a form of computing where resources are provided as a service over the internet. It enables the on-demand allocation or de-allocation of the central processing unit (CPU), as well as large-scale storage and network bandwidth. Moreover, it can meet scalability requirements to cater to user demands quickly; however, it does not require users to be experts on the technology that supports them. Cloud computing entails three major elements: software as a service – where applications are available on demand and on a subscription basis; utility computing – where server capacity is accessed across a grid as a variably priced and shared service; and virtualisation – where applications are separated from infrastructure. Derived from the principles of cloud computing, cloud hosting enables the sharing and management of large amounts of distributed data, representing the ultimate in scalability for unpredictable demands. It handles security, load balancing and server resources virtually, so users are not restricted to the limits of one physical piece of hardware or server. Instead, online operations have access not only to a number of servers distributed in real time, but to the heightened processing power that comes with them. So who uses such services, and could they be right for you? Cloud hosting is ideal for web developers who need a reliable platform for applications, but who would rather not meddle in the technological aspect of the operations. Thus, the service gives developers more room and flexibility to practice innovation, rather than having to worry about web servers. Indeed, there is much to take into consideration as to whether cloud hosting might be right for you and your web development services. Therefore, it is important that you understand as much as possible about such services; that way you can help determine if cloud hosting could be of benefit to you.

Adam Singleton writes for a digital marketing agency. This article has been commissioned by a client of said agency. This article is not designed to promote, but should be considered professional content.
WP Robot

Cloud Computing: The New Way to Host Websites and Other Computer Resources

November 18th, 2009

Cloud computing is the new IT trend that is grabbing the industry magazine headlines, and although it is being positively embraced by many users, some are needlessly worried about security issues. Bringing together the three major trends of virtualisation, utility computing and software as a service (SaaS), cloud computing is still regarded with a degree of suspicion by some. However, as both the US and UK governments utilise the technology they at least have no doubts over its use. It is the combination of the three component parts of cloud computing that make it particularly appealing to users as they need little or no knowledge of the technology needed to operate it. First used to describe large ATM networks in the early 1990s, when used in the computing context ‘Cloud’ is describing the internet and the way that resources are used across its entirety. It involves the provision of services to users who don’t have to worry about any of the technical issues surrounding the service. Because resources can be pulled from across the internet it means that cloud computing solutions are entirely scalable and peak loads are easily accommodated. That allows users to go about their business without having to worry about allocation of CPU, storage or network bandwidth. The shared hosting infrastructure model in regular use today is limited by the physical constraints of the available hardware, usually at one bottleneck point, such as single server. However, cloud hosting has no such restrictions as it utilises the processing power of a series of servers in real time. A user of cloud hosting simply purchases as much processing capacity as they require from a resource that is virtually inexhaustible and therefore provides a seamless service regardless of peaks and troughs in visitor numbers. Intelligent systems simply ensure that load-balancing is applied across a series of servers, adding or removing them from the cluster as required providing an invisible transition for customers. The technology underpinning the infrastructure enables small and medium–sized enterprises to utilise web hosting architecture in a way that was only available a large corporate IT department a few years ago. Cloud technology is now utilised by major corporations and governments throughout the world. It is certainly no fad, and despite myths about its lack of security is almost as robust as any traditional system; it is dependent upon the quality of the software and operator. There are also varying types of cloud, such as an on-premise cloud or a virtual private cloud, which are as secure as the system operator wishes them to be as it is in a private environment. However you would be constrained to your pre-configured environment.

Adam Singleton writes for a digital marketing agency. This article has been commissioned by a client of said agency. This article is not designed to promote, but should be considered professional content.
Dare2create Motivational Videos

Server power consumption going through the roof

November 17th, 2009

According to Dr Jonathon Koomey of the Uptime Corporation and a leading Stanford University professor, the amount of power consumed globally by servers doubled between 2000 and 2005.  By the end of 2005 the world was using 123 billion kilowatts of power to run the world’s servers.  This equates to more than 66 million tonnes of CO2 per annum.  For sure, it is likely to have at least doubled again since.  Alarmingly, Western Europe’s growth rate is above the world average so, in the IT arena at least – and contrary to popular opinion, the US are not the great pollutors – we Europeans are!  The same professor is suggesting massive increase in data centre usage is necessary to cope with the increasing global computing demand.

Reducing carbon emissions should be on every UK company’s agenda – particularly with Carbon Reduction Commitment legislation affecting larger public and private sector companies from April 2010 – and addressing server usage has never been more important.  By virtualising servers, companies can dramatically cut their carbon emissions both directly (by running fewer servers) and indirectly (reducing air conditioning requirements).  This is likely to save thousands of pounds of energy costs into the bargain. 

If businesses add in the high availability (HA) tools such as everRun from Marathon Technologies then business critical software stays up and running at a much higher level than before.  It really does make business sense – a lower hardware footprint, fewer carbon emissions, lower energy bills and business critical systems achieve 24/7 Uptime!

Tracy Barlow has worked in the field of marketing for more than 15 years and is Marketing Director of 24/7 Uptime http://www.247uptime.co.uk She is a Chartered Marketer and established her own marketing consultancy 2b Marketing http://www.2bmarketing.co.uk in 2000.
tinnitus cure

Making Your Business More Energy Efficient

November 16th, 2009

There are many reasons why making your company eco-friendly is such a great idea. There are also several myths about doing so – the major one being that it’s expensive. Making your company green doesn’t have to be expensive. In fact, it can save you money – so it’s really worth exploring what you can do to make a few changes. What’s more, in today’s society where more and more people are concerning themselves with the environment, ethical companies gain more public respect. If your company proves itself to be ethical regarding environmental concerns, you could find yourself gaining a few more loyal customers who are enticed by your moral attitude. So how can you green up your business? There are plenty of ways. The current buzz is all about reducing your carbon footprint, and one way of achieving this is by simply using less power. This may sound like a difficult task, but when you think about how many people don’t switch their computers off at the end of the night, or leave unnecessary lights on, a simple company email reminding people to do what they can to conserve precious energy is enough to make an adequate start. Conserve paper by emailing and discourage unnecessary photocopying. Another way to go green is to make changes to your IT department. Whether you have an in house server or your company is big enough to need a data centre, large or small, these machines use a great deal of power and it is easy to curb this. Technologies in the computing world, such as virtualisation and cloud computing have made it so that many IT aspects can be moved onto fewer servers rather than many, or placed online. Virtualisation allows you to ‘virtualise’ your servers and stack them all onto one machine that can access each interface. Cloud computing simply allows all software and applications to be accessed online, meaning far less hardware is needed and you can even let employees work from home, thus using less petrol due to being relieved of their daily commute. Greening up your business really can be simple, and it’s cost-effective too. Using less power means lower energy bills and the two IT technologies mentioned above cost just a tiny fraction of what traditional in-house IT amounts to. Having a green business is a satisfying, ethical practice and one that could lower your carbon footprint, gain your company more public respect and help you save money – so see what you can do to start going green.

Adam Singleton writes for a digital marketing agency. This article has been commissioned by a client of said agency. This article is not designed to promote, but should be considered professional content.
Your Raw Food Life

Virtualization Security – The How To Guide – Part 3

November 16th, 2009

OVERVIEW

In this the third technical article from Orthus that summarises much of the platform focused industry research that has taken place as regards issues associated with the security of virtualisation platforms, we outline the second  of three categories of virtualised platform specific vulnerabilities, namely that of virtual machine environment protection bypasses.

CONCERNS OVER ISOLATIONISM…

The detection of virtual machine environments (see previous article) is merely one weapon in the attackers’ armoury, and there exists a number of mechanisms for bypassing the supposed isolation between guest and host operating systems and processes. In the same presentation in which Ed Skoudis and Tom Liston discussed potential remote virtual machine environment detection, a number of utilities were highlighted that can bypass the isolation supposedly inherent in platform virtualisation technologies, particularly VMware. The utilities discussed were operable in VMware Workstation 4 and 5 (and may well be applicable to VMware Workstation 6). VMware Worsktation has an inbuilt communications channel that allows host and guest operating system instances to communicate (commonly referred to as a backdoor). By exploiting this functionality as well as DLL injection it was possible to generate a suite of tools designed to circumvent the isolation of partitions and platforms. As highlighted these tools have not been publicly disclosed as of the time of writing (this may be in no small part due to the fact that much of the research conducted by Ed Skoudis and Tom Liston is formerly sponsored by the United States Department of Homeland Security), however publicly released tools are available for both the attacker and legitimate researchers to utilise. Most notable amongst these is the VM Back suite of tools developed by Ken Kato[i] and other contributors. The VM Back suite of utilities exploits the Backdoor / IO functionality that forms part of many VMware binary distributions. This backdoor is used by the binary distribution to configure deployments of VMware during application runtime (interestingly, the official VMware Tools utilise this backdoor).  At the time of writing there are twenty known commands that can be issued via this backdoor functionality and impact upon VMware products for both Windows and Linux hosts, namely:

Command Number

Description

01h

Get Processor Speed

02h

Invoke APM function on virtual machine

04h

Get mouse pointer position

05h

Set mouse pointer position

06h

Get text length from clipboard

07h

Get text from clipboard

08h

Set text length to clipboard

09h

Set text to clipboard

0Ah

Get VMware version information

0Bh

Get device information

0Ch

Connect / Disconnect a device

0Dh

Get GUI options setting

0Eh

Set GUI options setting

0Fh

Get Host screen size

11h

Get virtual hardware version

12h

Popup “OS Not Found” dialog

13h

Get BIOS UUID

14h

Get Memory size

17h

Get Host system time

1Eh

Enhanced RPC

TOOLING & EXPOLITATION

By exploiting the functionality of Backdoor/IO operations, Ken Kato (and others) have been able to create a number of utilities that can be used to bypass the supposed isolation between guest and host operating systems operating in a virtual machine environment. Indeed in February 2008, security research group Core Labs, utilised one such application VMFTP to help exploit a vulnerability within VMware shared folders functionality (which was enabled by default) that allowed for users of a guest OS to obtain read and write access to the host OS.

NEXT TIME…

In our next article we will discuss final category of virtualised platform specific vulnerability, namely that of virtual machine environment destruction.

Sean Bennett is Commercial Director at Orthus, a leading professional services firm focused on helping organisations globally to secure their technical evironments and manage risk. For advice or support in securing your virualization deployment or virtualized environment contact Orthus (EMEA) on +44 (0)203 170 8955 or visit www.orthus.com
Free Wordpress Plugins

Virtualization Security – The How To Guide – Part 2

November 15th, 2009

OVERVIEW

In this the second of six technical articles from Orthus we summarise much of the platform focused industry research that has taken place on issues associated with the security of virtualisation platforms.  We also outline the first of three categories of virtualised platform specific vulnerabilities associated with virtual machine environment security anomaly detection.

SUFFERING FROM POOR MEMORY…

It is possible for attackers to detect virtual machine instances in a number of ways, but one of the most obvious attack vectors is to check for running processes in memory, for example reviewing Registry entries (if attackers are within a Microsoft Windows based OS), as well as reviewing the OS file system, for known files associated with particular virtualisation platform vendors. In such an approach an attacker is limited to the discovery of visible processes and assets, and many vendors may actively seek to obfuscate these values to help resist detection attempts.

Attackers can also seek to discover specific memory artefacts and detect anomalous behaviours introduced into memory by the virtualisation process. It may be possible for an attacker to search system memory for references to known virtual machine variants. This is not a trivial task to accomplish however, can be resource and performance intensive, and in addition attackers will need to compare the memory of both Host and Guest instances. Another potentially more elegant solution available to attackers seeking to detect virtual machines is to examine memory for pointers to critical Operating System tables.

One known memory differential is the location of the Interrupt Table Descriptor (IDT), which is responsible for determining where various OS system interrupt handlers are located in memory (and is often exploited by rootkit technologies). In many implementations of virtual machines, the IDT is commonly situated in a lower memory location than on a conventional OS. A number of tools exist to assist an attacker seeking to exploit this issue in relation to the discoverer of virtual machine environments, most notably, Kad’s CheckIDT which was detailed in Phrack 59 in 2002[1].

It is not necessary however for attackers to physically examine memory structures to detect virtual machine environments, and a number of widely available applications are available to assist in this process.  A number of researchers have taken advantage of the IDT checking concept, most notably Joanna Rutkowska, and Tobias Klein to detect virtual machine instances.

In 2004, Rutkowksa debuted the Red Pill[2], which utilises a single machine language instruction, SIDT (Store Interrupt Descriptor Table) which checks the IDT entries situated in the Interrupt Table Descriptor Register (IDTR).

In VMware guest machine instances, the IDT entry is typically situated at memory location 0xffXXXXXX, for Virtual PC instances, it is typically situated at 0xe8XXXXXX. The scoopy[3] utility issued by Tobias Klein in 2003 also utilises the SIDT instruction to check memory values and discover virtual machine environment instances, but is specifically directed towards the discovery of VMware instances.

In addition to utilising the SIDT instruction, Scoopy also checks for SGDT and SLDT. As with the IDT (measured using the SIDT instruction) other tables exist in memory whose location is shifted by the introduction of a virtual machine environment, namely the Global Descriptor Table, and the Local Descriptor Table. What Scoopy seeks to accomplish is a check of the results set created by utilising a SIDT instruction, by way of comparing the memory location of GDT and LDT with known virtual environment variables.  In addition to these tools, attackers have a variety of other resources that may be utilised to detect a virtual machine environment, most notably, VMDetect from Danny Quist, and the VME specific hardware checking utility, Doo from Tobias Klein.

CURRENT BARRIERS TO EXPLOITATION

In relation to current methods of detecting virtual machine environments, attackers and researchers alike are bound by one common issue namely that most available mechanisms require them to be authenticated, or else have physical access to the target machine.

A number of research projects are currently underway to overcome this limitation. In July 2007, Ed Skoudis and Tom Liston presented a number of findings concerning virtualisation security at the SANSFire conference[4]. As well as discussing a number of as yet to be released utilities, a method for the remote detection of virtual machine environments was discussed.

In their current research, Skoudis and Liston are seeking to define anomalies that exist in the timing of ICMP and TCP packets.  In addition, they have turned their attentions to timestamps and pattern recognition within packet headers. As virtual machine environments can often possess timing disparities (particularly with regards virtualised resources) this may well prove a fertile area of research, and remote detection utilities may well be available to attackers and researchers alike shortly.

NEXT TIME…

In our next article we will discuss second of three categories of virtualised platform specific vulnerabilities, namely that of virtual machine environment protection bypasses.

Sean Bennett is Commercial Director at Orthus, a leading professional services company focused on helping organisations globally to manage risk and secure technical environments. If you need any advice or assistance with securing your virtualised platform visit www.orthus.com
Accurate professional psychic reading – Get answers today!

Virtualization Security – The How To Guide – Part 4

November 15th, 2009

OVERVIEW

In this the fourth technical article from Orthus that summarises much of the platform focused industry research that has taken place as regards issues associated with the security of virtualisation platforms, we outline the final category of virtualised platform specific vulnerabilities, namely that of virtual machine environment destruction.

THE FALLIBILITY OF SOFTWARE

As has been highlighted in the preceding articles, there exist a number of mechanism whereby attackers can bypass the supposed isolations between guest and host operating system instances in a virtual machine environment, as well as a variety of mechanisms for discovering VMEs.

All software is fallible, and it is this fallibility that has been so successfully exploited by security researchers to date. One area of research that has received increased attention in recent years is the ability of virtualised environments to withstand hostile code. The most commonly cited work in this area was conducted by Tavis Ormandy of Google Inc, ‘An Empirical Study into the Security Exposure to Hosts of Hostile Virtualized Environments’[i]. In this work, Ormandy highlights a number of abnormal terminations within VMware products that cast doubt on the concept of isolation and separation within platform virtualisation technologies.

TOOLING

Utilising the IOFUZZ utility to generate random I/O activity within virtual machine instances, as well as the user-mode CRASHME utility developed by George Carette to subject the virtualised environments to stress testing of faults, Ormandy was able to trivially generate a series of unexpected error conditions and abnormal terminations within a variety of virtual machine environments.

EXPLOITATION

Should attackers possess the necessary privileges and permissions to access I/O ports within virtual machine environments, the virtual machine monitor instances could be compromised, and arbitrary code executed within the context of the running process.

This area of research has yet to receive directed attention from security researchers and public results are still scant, however in current conditions, an attacker may be able to trivially create abnormal terminations within virtual machine environments using simple error fuzzing, and this is potentially a fertile area for future malicious code.

NEXT TIME…

In our next article we will discuss final category of virtualised platform specific vulnerability, namely that of virtual machine environment destruction.

As can be seen in this and the preceding articles, a number of research efforts have been expended upon defining the threats and vulnerabilities present within virtualised platform technologies.

Orthus is a leading professional services firm helping clients globally to manage technology risk and secure their environments. To learn more about what Orthus can do for you visit www.orthus.com
hazardous
Powered by Yahoo! Answers