on Sep 21st, 2006
VM Host Access is Physical Access
In the last year I have seen a huge explosion in the use of virtual machine technology for critical infrastructure systems. Many of us have long used virtual machines for testing, software development, and research, but many organizations are increasingly using virtual machines for critical servers. I have seen some companies implement their entire DMZ on a single box, build scalable mail systems spread across a few vm hosts, even an ISP that uses Linux-based virtual machines for many of its backbone routers. There is also a growing number of pre-built virtual appliances becoming available.
So far we haven’t seen a lot of public exploits of vm technology, but I have been noticing some implementation problems that are a recipe for disaster. One of the most common problems is that having access to the vm host is the same as having physical access to a box, and in some cases even worse.
