VM user? Watch out for Venom...

The exploit affects virtual machines including Xen, KVM, and native QEMU platforms

Virtual machine data is at risk from a newly-discovered vulnerability dubbed Venom.

Hackers using Venom can steal privileged credentials for a company's entire IT infrastructure by breaking through the protections cloud service providers use to separate each customer's data.

Once attackers gain the information to access one area, they are able to access other virtualised environments, compromising the entire corporate network.

The zero-day exploit was found this week by threat intelligence firm CrowdStrike, which warned that it dates back to 2004.

Jason Geffner, the senior security researcher who discovered the flaw, said it affects virtual floppy drive code used by virtual machines.

"This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host," he wrote.

"This VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems."

However, CyberArk cyber crime expert, John Worrall, said most organisations have isolated their virtual environments from external users, making them immune from the attack.

But those without isolated environments risk suffering devastating attacks, he added, saying: "When an attacker gains privileged access, they exploit it to anonymously survey a company's security posture, often for months at a time.

"With this knowledge, they can easily execute their attacks undetected, whether it's exfiltrating information as part of espionage campaign, implanting malware as part of a financially motivated attack, or simply destroying a company's ability to do business, as was done to Sony Pictures."

Some have compared the attack to Heartbleed, the OpenSSL flaw that let attackers spy on data being sent online.

However, Karl Sigler, Threat Intelligence Manager at Trustwave doesn't think it's as serious a threat as Heartbleed.

"There are no known in-the-wild attacks and a patch is available," he said. "The virtualisation products it does affect are popular (XEN, KVM, QEMU, and VirtualBox), but the absence of VMWare and Microsoft as affected eases the blow in a lot of cases.

"I would see this attack typically used to target hosting companies that use virtual environments like KVM. An attacker would purchase a KVM instance then use VENOM to breach the hosting machine."

Symantec agreed, its response team adding: "Heartbleed affected a huge number of websites, applications, servers, virtual private networks, and network appliances. Meanwhile, VENOM only affects virtualization systems that specifically use QEMU's Floppy Disk Controller and does not impact some of the most widely used VM platforms."

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

Geico data breach leads to stolen driver’s license numbers
data breaches

Geico data breach leads to stolen driver’s license numbers

21 Apr 2021
UK’s IoT security regulation will also include smartphones
Internet of Things (IoT)

UK’s IoT security regulation will also include smartphones

21 Apr 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021
Mastering endpoint security implementation
Security

Mastering endpoint security implementation

16 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021