0

I'm exploring the threats for VDIs on VMware, based on the article it seems the risk for VM escape has low severity as described here:http://vmescape.com/index.html

Did we forget the discussion of "Risk Management"? Is there a risk? Of course. There is also a risk of getting in a car crash as you drive to work. But you still do, right? Because the risk is very, very small. And I would argue that the risk of a true "take over the hypervisor" level VM Escape is FAR smaller than your getting in a crash on the drive to work.

I also wish to understand the severity of VM escape.

closed as primarily opinion-based by kalina, forest, multithr3at3d, ThoriumBR, Royce Williams May 9 at 5:42

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    If someone steals medical records via a hypervisor escape and sells that information to insurance companies who use that information to deny someone insurance, that person can die. That can be as severe, or more severe, than getting into a car crash. – forest Apr 7 at 3:18
  • 1
    @forest: with the same argumentation a simple car crash might lead to somebody getting mentally unstable and going amok which results in many death. One thing is the risk of the vulnerability itself - another is the context in which the vulnerability gets exploited. – Steffen Ullrich Apr 7 at 6:27
  • @SteffenUllrich The difference is that an insurance company wants to find reasons to deny someone an insurance claim, never the opposite. A person who has become mentally unstable is not necessarily more likely to go and kill a bunch of people than they are to become donate all their belongings to charity and become a monk. In other words, it's more accurate to say that insurance companies refusing to pay out is likely to cause deaths than it is to say that mental instability from a car crash is likely to cause deaths. – forest Apr 7 at 6:38
  • 1
    This questions twists the meaning of what vmware describes: vmware only uses the risk of a car crash to explain the difference between high and low risks and that low risks are often accepted in real-life since they are low. They are in no way claim that the risk and severity of the car crash is equal to the risk and severity of an VM exploit as the OP seems to be read into their arguments. The actual severity depends a lot on the context, i.e. a VM exploit in an environment with lots of secret data is worse than in a test system. – Steffen Ullrich Apr 7 at 6:46
  • 1
    @Filopn: Your question explicitly asks if both having the same severity - and cite information from vmware as the basis of your question. Only, vmware never compares the severity of both - they only use car crash as an example how low risk gets accepted in real life. The attempt to compare both is only from you. So why cite vmware if what they say has essentially nothing to do with what you ask. – Steffen Ullrich Apr 7 at 7:32
3

Depends on your threat model

VM escape vulnerabilities are, in general, rare compared to other classes of vulnerabilities - there are less such vulnerabilities found each year than e.g. critical vulnerabilities in mainstream operating systems or their bundled components. Assuming that there currently aren't any known unfixed vulnerabilities for VMWare, and that you have the latest VMWare version (which is a reasonable assumption most of the time) this means that you're only vulnerable to attack by an attacker exploiting an as-of-yet unknown zero-day vulnerability. In general, this is expensive - such a zero-day vulnerability can be bought or sold for something in the ballpark of $100 000 so you should expect that this amount of resources would not get "wasted" on a low value target.

So the question is whether it's plausible that someone would spend $100 000 to attack you - most people are low value targets, and in this case there's no "economy of scale" where it would make sense for an attacker to attack lots of random computers (e.g. for ransomware or spam) as most such targets wouldn't have VMs and there's little additional benefit; something like Cryptolocker would bring only marginally more revenue to the attacker if it also included a VM escape exploit.

If you consider that your attackers are likely to spend a substantial amount of resources to target your systems specifically, and your systems can be targeted by a VM escape exploit, then you should consider VM escapes as likely, and not otherwise. It's also worth noting that in order to do a VM escape, the attacker generally needs to gain code execution. So if you are intentionally running attacker-provided code (e.g. as an antivirus company or running code tests for anonymous third parties) then the risk becomes much higher than simply running virtualized servers.

Iccording to SANS criteria, that's not low severity but medium severity - "Vulnerability requires significant resources to exploit, with significant potential for loss".

Not the answer you're looking for? Browse other questions tagged or ask your own question.