-1

How secure are all currently used virtualization technologies (containers - BSD Jail, OpenVZ, Hypervisors - Hyper-V, KVM etc)?

I heard about one vulnerability in VMware software, which lets you break out of the guest machine.

What's the most secure option? I need this for malware analysis.

closed as too broad by multithr3at3d, Adonalsium, forest, Tom K., LvB May 13 at 12:11

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • How secure are all technologies? You are going to have to narrow down your criteria. And just because one technology had a vulnerability one time, does not mean that that technology still has that vulnerability. The answers you are going to get are about how to employ different approaches to virtualisation for defence in depth. – schroeder May 4 at 12:32
  • Do I really need to narrow down my criteria if I want a summarized answer? @Steffen Ullrich answered pretty much what I asked, but I'll wait a bit to get different opinions before choosing his answer as the solution. – Sir Muffington May 4 at 15:08
  • Note that BSD Jails and OpenVZ are containers, not hypervisors. – forest May 11 at 4:47
  • Thank you forest for correcting me. – Sir Muffington May 13 at 13:19
2

First, this is a pretty broad question since there are many virtualization technologies. So please don't expect an in-depth comparison of each of these. There are actually several resources on the internet which provide more detailed information, like Security aspects of virtualization from enisa. A simple Google search will provide even more resources. Thus this is mainly a summary without too much details which also only covers the main technologies:

The main virtualization technologies are full virtualization like offered by KVM, VirtualBox, vmware ESXi, Hyper-V etc on the one side and container based virtualization like done in LXC, OpenVZ, BSD jail etc on the other.

Full Virtualization

In full virtualization the virtual machines share performance critical host hardware like CPU and RAM with some hardware-assisted separation but emulates other hardware like network cards or display (but there are technologies to share parts of such hardware too). Inside the guest VM there is a full OS like Windows or Linux which does not need to have special drivers to deal with the virtualization. But there are usually special drivers anyway since these make it possible to have more performance (like using hardware-assisted sharing of host resources) and more flexibility (like changing the amount of RAM and CPU without rebooting the guest VM).

The main attack path in full virtualization is this hardware emulation, since it usually requires some kind of complex interaction between host and guest. Bugs in this separation allow the guest to break out the virtualization. But usually an attacker running inside the guest VM has to break several security layers to be successful: first he needs to find a problem in his execution environment, use this to elevate privileges inside the guest VM, use this to break out of the guest and then find and use an attack against the VM host.

Container Based Virtualization

Container based virtualization is weaker but also provides more performance since the virtualized processes are just normal processes running inside the host OS and using the host kernel. The separation is done with namespaces, i.e. namespace for network, for users, for process ids etc. This also means that you cannot run a completely different OS inside a container, i.e. you cannot run Windows inside a Linux container like LXC etc. You could though run for example RedHat inside an LXC running on Ubuntu since they both use the Linux kernel.

Compared to the small hypervisor in full virtualization the container based virtualization is way more complex and provides a larger attack surface. On the other hand there is no need for complex emulation of hardware either since guests use the same kernel as the host. But a security issue inside the kernel would allow an attacker inside the guest to take over the host, while with full virtualization it would only allow the attacker to take over the guest VM.

Summmary

Full virtualization provides more security than container based virtualization. Additionally container based virtualization is restricted it what you can do, specifically you are not able to run a different OS. Thus it might not be a usable platform for malware analysis in the first place.

But, if you could do your analysis either inside a container or inside a VM you could actually combine both to provide even more security: you could run a VM with a full OS inside and then use containers inside these virtualized OS to add an additional layer of separation for added security.

  • So basically running different kind of a VM in an another VM is the way to go for malware analysis? – Sir Muffington May 4 at 11:33
  • @SirMuffington: the more separation layers you have the better it is in terms of security. I.e. if possible use a container inside a VM with full virtualization, but then don't put the VM host inside your network either to add another separation. But for malware analyzes other aspects are relevant too, like performance and overhead if you do lots of analysis and also how easy the virtualized environment is detectable by the malware so it can adjust its behavior to not behave malicious. – Steffen Ullrich May 4 at 11:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.