Smau 2010 MIlano: Seminario AIPSI Virtualizzazione Sicura

•

1 like•663 views

Alessio L.R. Pennasilico, known online as mayhem, presented on virtualization security risks. He discussed classical threats like VM escapes and malware that is aware of virtualization. He raised questions about securing management traffic and traffic between virtual machines. Pennasilico concluded that virtualization can be used securely but only if networks divide traffic, filter what is allowed, continuously analyze for threats, and ensure all software is patched. The presentation aimed to promote awareness of virtualization security issues.

Technology News & Politics

Alessio L.R. Pennasilico
mayhem@aipsi.org
twitter: mayhemspp
FaceBook: alessio.pennasilico
Virtualization (in)security
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
$ whois mayhem
Board of Directors:
CLUSIT, Associazione Informatici Professionisti,
Associazione Italiana Professionisti Sicurezza Informatica,
Italian Linux Society, OpenBSD Italian User Group,
Hacker’s Profiling Project
2
Security Evangelist @
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Classical threats
Escape from VM
diversi esempi nel tempo,
ne vedremo altri in futuro :)
3
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
altre minacce
malware vm-aware
4
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Confidenzialità
posso clonare macchine accese
e fare quello che voglio sui cloni?
5
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Management VLAN
Gli host/hypervisor si dicono
diverse cose interessanti
Dove facciamo passare il
trafﬁco “di servizio”?
6
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Traffico di servizio
accesso all’interfaccia amministrativa
test reachability per HA
vMotion
iSCSI, NFS
7
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Soluzioni?
Dividere
Filtrare
Analizzare
8
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Logical
9
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Physical
10
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
disruption
Cosa succede se rendo “irraggiungibili” gli
IP monitorati per la gestione dell’HA?
11
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Unauthorized access
Brute force?
Exploit (undocumented services)?
Exploit application layer? (SOAP)
12
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
netstat
tcp

0

0
0.0.0.0:5989

0.0.0.0:*

LISTEN
tcp

0

0
0.0.0.0:902

0.0.0.0:*

LISTEN

tcp

0

0
0.0.0.0:903

0.0.0.0:*

LISTEN

tcp

0

0
0.0.0.0:427

0.0.0.0:*

LISTEN

tcp

0

0
0.0.0.0:80

0.0.0.0:*

LISTEN

tcp

0

0
0.0.0.0:22

0.0.0.0:*

LISTEN

tcp

0

0
0.0.0.0:443

0.0.0.0:*

LISTEN

13
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Perchè
intercettare / rallentare il traffico iSCSI / NFS
storage in replica per HA/DR
14
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Migration
Manipolare le VM durante la migrazione?
http://www.eecs.umich.edu/techreports/cse/2007/CSE-TR-539-07.pdf
Jon Oberheide, Evan Cooke, Farnam Jahanian: Xensploit
15
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Migration
Posso spostare VM infette
di datacenter in datacenter...
16
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Dubbi...
traffico “trusted” tra datacenter per garantire
la migration delle VM?
Traffico protetto?
Traffico Trusted / VPN come canale di
accesso amministrativo?
17
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Dormant VM
outdated policy
outdated signatures (AV, IPS)
manipolabili? >;-)
18
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Botnet e Cloud?
19
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Traffico interVM
firewall virtuali?
feature dell’hypervisor?
prodotti di terze parti?
20
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Prodotti agent based
multipiattaforma?
(comprende backup, AV, IPS...)
21
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Budget?
81% delle intrusioni avvengono su reti che non
sodisfano i requirement delle più diffuse
norme/best practice / guidelines
Gartner
22
Thursday, 21 October, 2010

Virtualization (in)security mayhem@aipsi.org
Conclusioni
Usare la virtualizzazione?
Si, ma…
Dividere, Filtrare, Analizzare, Patchare
23
Thursday, 21 October, 2010

Alessio L.R. Pennasilico
mayhem@aipsi.org
twitter: mayhemspp
FaceBook: alessio.pennasilico
Domande?
These slides are written by Alessio L.R. Pennasilico aka mayhem. They are subjected to Creative Commons Attribution-
ShareAlike 2.5 version; you can copy, modify or sell them. “Please” cite your source and use the same licence :)
Grazie per l’attenzione!
Thursday, 21 October, 2010

Viewers also liked

Linux Day 2010: Linux Security Demystified

Alessio Pennasilico

Come il Cloud Computing può salvare l'analogico

Alessio Pennasilico

Rischi o vulnerabilità?

Alessio Pennasilico

Smau 2010 Milano: Seminario AIPSI Sicurezza del VoIP

Alessio Pennasilico

Consagração

joyceslideshare

Seminario Clusit Security Summit 2010: Minacce per la virtualizzazione

Alessio Pennasilico

Linux Day 2010: Virtualizzare con OpenVZ

Alessio Pennasilico

Viewers also liked (7)

Linux Day 2010: Linux Security Demystified

Come il Cloud Computing può salvare l'analogico

Rischi o vulnerabilità?

Smau 2010 Milano: Seminario AIPSI Sicurezza del VoIP

Consagração

Seminario Clusit Security Summit 2010: Minacce per la virtualizzazione

Linux Day 2010: Virtualizzare con OpenVZ

Similar to Smau 2010 MIlano: Seminario AIPSI Virtualizzazione Sicura

Time Sensitive Networking in the Linux Kernel

henrikau

This was the opening presentation of the Zenoh Summit in June 2022. The presentation goes through the motivations that lead to the design of the zenoh protocol and provides an introduction of its core concepts. This is the place to start to understand why you should care about zenoh and the way in which is disrupts existing technologies. The recording for this presentation is available at https://bit.ly/3QOuC6i

Zenoh: The Genesis

Angelo Corsaro

(120107) #fitalk anonymizing activities

INSIGHT FORENSIC

ICT Security 2010: Le minacce delle nuove tecnologie

Alessio Pennasilico

The Good The Bad The Virtual

Claudio Criscione

Full Disk Encryption (FDE) may be rather useful as a defense mechanism against potential theft of a computer system. However, when the system is compromised and requires careful forensic analysis, FDE can be quite painful to forensic analysts. Unless you deal with standard and widely supported encryption such as LUKS, Bitlocker, TrueCrypt or few others, it might really hard to get through the layers of crypto code in proprietary software. This presentation delivered at HTCIA (HIGH TECHNOLOGY CRIME INVESTIGATION ASSOCIATION - Singapore) highlights few techniques to let a remote analyst perform investigations. https://htcia.org

Needle In An Encrypted Haystack: Forensics in a hardened environment (with Fu...

Nicolas Collery

Security theatre (Scotland php)

xsist10

Building a large eCommerce application with Extbase, Fluid and Apache Solr

netlogix

Sensor networks are a fundamental building block of Internet of Things (IoT) applications, as they provide the interface to the physical world. In fact, many techniques used for resource-constrained IoT devices originated in the research area of Wireless Sensor Networks (WSNs). This talk will present the transition from research prototypes to standardized Internet protocols, give an overview how sensor networks are connected today (with a practical hands-on), and discuss a few challenges that need to be addressed in the future.

Virtual IoT Meetup: Connecting Sensor Networks

Matthias Kovatsch

News bytes Oct-2011

Ashwin Patil, GCIH, GCIA, GCFE

Full Disk Encryption (FDE) may be rather useful as a defense mechanism against potential theft of a computer system. Usually such protections comes with some levels of hardening like removing administrative rights. However, when the system is compromised and requires careful forensic analysis, FDE and hardening can be quite painful to forensic analysts. This presentation delivered at IIC-SG-2018 (Infosec In the City - Singapore) and at Div0 (Division0 local security meetup) highlights few techniques to let a remote analyst perform investigations. https://www.infosec-city.com https://www.meetup.com/div-zero/

Let Me Pick Your Brain - Remote Forensics in Hardened Environments

Nicolas Collery

Security Theatre (PHP Leuven)

xsist10

We used to believe that some software is secure. I'd like to decompose our faith in it by touching every prime factor of our daily computing environments. This implies the roller-coaster ride from user space to the farthest parts of the Universe by 0.1-days and oddities of software that we use each day. Our goal is to realize how many assumptions are hidden in saying that some piece of code is secure.

Trust boundaries - Confidence 2015

Logicaltrust pl

PLNOG 5: Adam Jacob - Choose your own PLNOGventure

PROIDEA

Virtualisation of ICT infrastructure has been one of the more recent strategies to achieve substantial technical and commercial gains from your technology investment; organisations of all sizes are either evaluating it or using it! So what’s the catch? Put simply, the principles of information security are regularly overlooked during the planning and deployment stages of a virtualisation program. This webinar will explore some of the security risks that organisations inadvertently expose there businesses to when deploying virtualised infrastructure. Furthermore the presenter will discuss the fundamentals of information security, and importantly how to apply these fundamentals in a virtualised environment to manage risk and protect critical information assets.

Sense of Security - Securing Virtualised Environments; Focus on the Fundamentals

Jason Edelstein

DefCon 2012 - Hardware Backdooring (Slides)

Michael Smith

[Confidence0902] The Glass Cage - Virtualization Security

Claudio Criscione

Security Theatre - Confoo

xsist10

Security Theatre - Benelux

xsist10

RabbitMQ is a complete and highly reliable enterprise messaging system based on the emerging AMQP standard. It is licensed under the open source Mozilla Public License and has a platform-neutral distribution, plus platform-specific packages and bundles for easy installation. In this talk, Alexis talks on use cases for cloud messaging.What is messaging and why it is useful for cloud computing? This talk will answer these questions by way of illustrating use cases from RabbitMQ customers.

Use cases for cloud messaging

Skills Matter

Similar to Smau 2010 MIlano: Seminario AIPSI Virtualizzazione Sicura (20)

Time Sensitive Networking in the Linux Kernel

Zenoh: The Genesis

(120107) #fitalk anonymizing activities

ICT Security 2010: Le minacce delle nuove tecnologie

The Good The Bad The Virtual

Needle In An Encrypted Haystack: Forensics in a hardened environment (with Fu...

Security theatre (Scotland php)

Building a large eCommerce application with Extbase, Fluid and Apache Solr

Virtual IoT Meetup: Connecting Sensor Networks

News bytes Oct-2011

Let Me Pick Your Brain - Remote Forensics in Hardened Environments

Security Theatre (PHP Leuven)

Trust boundaries - Confidence 2015

PLNOG 5: Adam Jacob - Choose your own PLNOGventure

Sense of Security - Securing Virtualised Environments; Focus on the Fundamentals

DefCon 2012 - Hardware Backdooring (Slides)

[Confidence0902] The Glass Cage - Virtualization Security

Security Theatre - Confoo

Security Theatre - Benelux

Use cases for cloud messaging

Recently uploaded

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

Zilliz

Scalable LLM APIs for AI and Generative AI Application Development Ettikan Karuppiah, Director/Technologist - NVIDIA Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...

apidays

Modernizing Securities Finance: The cloud-native prime brokerage platform transforming capital markets. Madhu Subbu, Managing Director, Head of Securities Finance Engineering Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu

apidays

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

Real Time Object Detection Using Open CV

Khem

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...

Zilliz

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

Artificial Intelligence Chap.5 : Uncertainty

Khushali Kathiriya

Whatsapp Number Escorts Call girls 8617370543 Available 24x7 Navi Mumbai Call Girls Service Offer Genuine VIP Model Escorts Call Girls in Your Budget. Navi Mumbai Call Girls Service Provide Real Call Girls Number. Make Your Sexual Pleasure Memorable with Our Navi Mumbai Call Girls at Affordable Price. Top VIP Escorts Call Girls, High Profile Independent Escorts Call Girls, Housewife Women Escorts Call Girl, College Girls Escorts Call Girls, Russian Escorts Call girls Service in Your Budget.

Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model

Deepika Singh

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

A Beginners Guide to Building a RAG App Using Open Source Milvus

Zilliz

Created by Mozilla Research in 2012 and now part of Linux Foundation Europe, the Servo project is an experimental rendering engine written in Rust. It combines memory safety and concurrency to create an independent, modular, and embeddable rendering engine that adheres to web standards. Stewardship of Servo moved from Mozilla Research to the Linux Foundation in 2020, where its mission remains unchanged. After some slow years, in 2023 there has been renewed activity on the project, with a roadmap now focused on improving the engine’s CSS 2 conformance, exploring Android support, and making Servo a practical embeddable rendering engine. In this presentation, Rakhi Sharma reviews the status of the project, our recent developments in 2023, our collaboration with Tauri to make Servo an easy-to-use embeddable rendering engine, and our plans for the future to make Servo an alternative web rendering engine for the embedded devices industry. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://ossna2024.sched.com/event/1aBNF/a-year-of-servo-reboot-where-are-we-now-rakhi-sharma-igalia

A Year of the Servo Reboot: Where Are We Now?

Igalia

In the thrilling conclusion to 2023, ransomware groups had a banner year, really outdoing themselves in the "make everyone's life miserable" department. LockBit 3.0 took gold in the hacking olympics, followed by the plucky upstarts Clop and ALPHV/BlackCat. Apparently, 48% of organizations were feeling left out and decided to get in on the cyber attack action. Business services won the "most likely to get digitally mugged" award, with education and retail nipping at their heels. Hackers expanded their repertoire beyond boring old encryption to the much more exciting world of extortion. The US, UK and Canada took top honors in the "countries most likely to pay up" category. Bitcoins were the currency of choice for discerning hackers, because who doesn't love untraceable money?

Ransomware_Q4_2023. The report. [EN].pdf

Overkill Security

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Recently uploaded (20)