We previously talked about using 2
Virtual Machines or VMs for testing. 3
Now we’re going to go through using VMs 4
for creating separate security domains 5
and forcing isolation 6
and compartmentalization with them. 7
VMs are a kindof sandbox 8
and are an excellent tool 9
for implementing isolation 10
and compartmentalization 11
to reduce risk, 12
impact and to control an attacker. 13
They’re also a great tool for establishing isolation 14
and compartmentalization for aliases, 15
as discussed in the section on Op Sec. 16
You must have some sort of isolation 17
and compartmentalization for aliases, 18
whether that be virtual for a virtual machine 19
or physical. 20
Virtualization provides security 21
because it reduces the interfaces 22
between the security domains 23
while allowing security domains 24
to exist and communicate 25
through those interfaces. 26
Security domains that just exist in isolation 27
have limited use 28
as they have nothing that they can communicate with. 29
They do have their purpose, 30
but it’s a limited use case. 31
So we use virtualization 32
because it reduces those 33
interfaces between the security domains 34
while still allowing the domains to exist 35
and communicate through those interfaces. 36
Hopefully, you set up the test environment, 37
have been going through the course and 38
testing various things out. 39
So you should now be familiar with VMware 40
and/or VirtualBox, 41
these are the Type 2, hosted hypervisors. 42
The hypervisor is installed 43
on the operating system that you have. 44
The main Type 2 hosted hypervisors are 45
VirtualBox, as we’ve mentioned. 46
There’s a VMware player and the workstation. 47
VMware also has something called VMware Fusion, 48
which is for Mac. 49
There’s something called Parallels desktop 50
which is for Mac. 51
There’s also Vagrant, VPC, 52
and Citrix desktop player, 53
which is for Windows and Mac. 54
I recommend VirtualBox for security, 55
privacy and anonymity, as it’s free. 56
So there is no money trail 57
if non-attribution is important to you. 58
Also, VirtualBox has snapshots. 59
VMware doesn’t have snapshots 60
on the free version. 61
Snapshots are a useful security feature 62
to return back to a known good state. 63
Snapshots enable you to make a permanent backup 64
of the entire virtual machine 65
and then restore back to that virtual machine. 66
So it’s a useful feature for security 67
to return back to a known good state, as I said. 68
So that’s the Type 2 hypervisors 69
which you should be reasonably familiar with, 70
with your use of VirtualBox or VMware. 71
Now there’s the Type 1 native hypervisors, 72
also called bare metal hypervisors. 73
There is no host operating system. 74
In fact, the hypervisor is really 75
the host operating system. 76
Common Type 1 native bare metal hypervisors 77
include VMware, ESX and ESXi. 78
There’s also Oracle VM Server, 79
Microsoft’s got its HyperV product, 80
and there’s also the free and open sources XenServer. 81
Type 1 hypervisors have the advantage of being faster 82
and probably more secure, 83
as there is a reduced attack surface. 84
There’s no operating system that their sat on 85
that can be attacked. 86
You might set up a 87
Type 1 hypervisor on a server on your network, 88
or remotely in the cloud to escape 89
an adversary’s sphere of influence 90
that host virtual machines for you. 91
I like using XenServer which is free. 92
I have a XenServer on my local network 93
which hosts many of my virtual machines, 94
and you can install XenServer 95
just like any other operating system. 96
You can even install XenServer 97
in a VirtualBox if you want to 98
play around with it and see how it works. 99
Simply download the ISO 100
and install it like any other operating system. 101
And that’s what the interface looks like. 102
It’s very similar to VirtualBox and VMware. 103
It’s just dedicated on its own server. 104
Other than Type 1 and Ty pe 2, 105
there’re also hybrid 106
hypervisors that effectively 107
convert the host operating system to a Type 1 hypervisor. 108
That might also be of interest to you 109
because you can use it for security, 110
for isolation 111
and compartmentalization. 112
First is KVM or Kernel Virtual Machine. 113
It’s an open source, fast, 114
GPL-licensed hypervisor that 115
comes with GNU Linux OS. 116
And other than VirtualBox and Xen, 117
I can also recommend this 118
as a virtual machine for Linux. 119
But do make sure you use it 120
with Virtual Machine Manager, 121
which is a front-end GUI for KVM, 122
making it simpler and easier to use. 123
And that looks like this and as you can see, it’s 124
pretty similar to VMware and VirtualBox. 125
And then when you want to see the settings for the virtual machines, 126
again it’s pretty similar to VMware and VirtualBox. 127
You can see all your various options 128
for setting up the virtual machine. 129
If you’re considering using KVM, 130
here’s a guide for Debian Jessie, 131
you can see it’s not too difficult. 132
The packages are available in the repository. 133
Simply install them and give it a try. 134
It works with Whonix, 135
which is a security-based operating system 136
we’re going to talk about shortly. So if you want to use Whonix, 137
you might well be using it with KVM 138
if you’re using Linux. But as I said, 139
we’ll discuss that shortly. 140
There are quite a few Linux VMs. 141
KVM probably is the main one 142
as it does come with GNU Linux OS, 143
but a couple of others worth a mention 144
is OpenVZ which is a container based virtualization, 145
and also Linux Containers 146
which, as the name suggests, is another container-based 147
virtualization application. 148
FreeBSD uses a mechanism they call jails, 149
which are independent environments 150
implemented via operating system-level virtualization, 151
wherein each jail is a virtual environment with its own files, 152
processors, and user accounts 153
and bound to a different IP address. 154
And each jail is completely sealed off from the other. 155
If you use FreeBSD, you will be aware of it already, I’m sure. 156
This works very effectively as an isolation and compartmentalization security control. 157
Anyone familiar with Oracle Solaris will know that there’s a similar concept 158
which they refer to as Zones. 159
I’ve worked with those at some banks, 160
but Solaris is not a very used operating system at the moment. 161
Finally, there is Docker which is quite the buzzword at the moment. 162
To explain what Docker is, let me show you this diagram. 163
If you think about VM hypervisors such as HyperV, 164
KVM and Xen, 165
they’re all based on emulating virtual hardware. 166
That means they’re heavy, relatively, 167
in terms of system resources. 168
Docker containers, however, use shared operating systems. 169
That means they are much more efficient 170
than hypervisors in system resourced terms. 171
Instead of virtualizing hardware, containers rest on top 172
of a single Linux instance, 173
meaning you have a small capsule containing your applications. 174
Docker’s becoming very popular for businesses because of this. 175
It enables virtualization with lower system requirements. 176
So Docker’s another option for isolation, but it is mostly implemented server side. 177
Solaris’ Zones works very similar to this. 178
You can also get what is called a Virtual Appliance. 179
Here are examples from TurnKey Linux, 180
a service I use and highly recommend. 181
They integrate with Amazon web services and you can deploy 182
virtual servers in, literally, seconds. 183
So let me give you an example. 184
Maybe you want to run a VPN server, an open VPN server in the cloud 185
via Amazon web services. 186
With a pre-configured virtual application, 187
the time and skill to do it is vastly reduced. 188
You’re able to select the virtual appliancethat you want to use, 189
in this case OpenVPN, 190
and quickly and easily deploy a full virtual server 191
with operating system and OpenVPN 192
within minutes based on this virtual appliances configuration. 193
Or maybe you want a domain controller to authenticate local network users. 194
You can take this and install it on VirtualBox or a dedicated XenServer 195
you’ve got a local domain controller that’s already set up and configured. 196
You’ll obviously need to configure it a little bit for your environment, 197
but it’s there, pre-made. 198
You do of course have to trust 199
TurnKey that they’re not backdoored it in some way, 200
but in the same light, we have to trust all operating systems 201
and applications, as well as virtual appliances. 202
We’ll talk more on TurnKey Linux later in other sections. 203
This is Wikipedia’s page comparing all the platform virtualization software 204
and there is loads of them, 205
as you can see here. 206
So that’s a useful link to see what’s out there. 207
What I’ve covered is what I see as the best, 208
but there are many, many alternatives. 209
Moving away from dedicated virtual machines, 210
it’s inevitable that operating systems will move to using virtualization 211
as part of its core security. 212
Windows 10 has made that move already. 213
Windows 10 Device Guard uses hardware technology and virtualization 214
to isolate the decision-making functions 215
from the rest of the operating system, 216
which helps provide protection from attackers 217
or malware that have managed to gain admin rights. 218
Type 1 hypervisor technology that is used to run virtual machines 219
in Microsoft HyperV is used to isolate 220
core Windows services into a virtualization-based 221
protected container. 222
These hardware-protected containers are guarded by the IOMMU 223
and other mechanisms within the CPU. 224
So you can see that Windows 10 225
has taken quite a leap into security through isolation 226
compartmentalization by implementing 227
this Windows 10 Device Guard. 228
This will make Windows 10 harder to compromise. 229
And I talk more on Device Guard in its own section, 230
but it’s obviously worth mentioning in this section on virtual machines 231
as that is where operating systems core security functionality, 232
I believe, is moving towards.