Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
OpenSSL.org Defaced by Attackers Gaining Access to Hypervisor

By now, most of you have heard that the openssl.org website was defaced.  While the source code and repositories were not tampered with, this obviously concerned people.  What is more interesting is that the attack was made possible by gaining access to the hypervisor that hosts the VM responsible for the website.  Attacks of this sort are likely to be more common as time goes on as it provides easy ability to take over a host without having to go through the effort of actually rooting a box.  (Social engineering credentials is easy, ask the Syrian Electronic Army... actual penetrations take effort).

The key takeaways are to obviously protect the Hypervisor from unauthorized access.  Beyond that, protect your VMs as if they are physical machines and as feasible use a BIOS password, boot password, disable DVDROM and USB storage.  Don't trust the hypervisor or VM host to secure your machine for you.  For additional reading, see this NIST Guide to Security for Full Virtualization Technologies.

More on the openssl.org defacement as it develops.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Bambenek Consulting

John

248 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!