Can host hacker break into guest that uses full disk encryption?

I know it is unlikely but let us say host has got owned, ie a hacker has managed to break into the host.
How would they go about breaking into a linux VM that uses full disk encryption?
They can't mess with the .vmdk without damaging it - it is encrypted by the guest.
They can't use vmrun because they do not know the guest passwords.
They can't attach to processes in the guest with debugging tools because they cannot see individual guest processes.
What can they do? And crucially, what can I do as a countermeasure?

What really matters is WHERE you do the encryption. If the encryption is too low, data in the guest appears unencrypted. If it is in the guest, then the keys live in the guest and since SGX is not around at the moment, keys are somewhere in guest memory even for a little bit of time.
So the real question is what are you trying to achieve?
If you are trying to meet encryption at rest requirements then it makes no difference where you encrypt as the data on the disk will be encrypted and without the key no one can decrypt it. Now if you have keys generated within a VM without using DRNGD or some other high quatlity randomness source, then your keys could be predictable and you need to guard against making it easy for a brute force attack.
If you need to encrypt data in motion?
Then you need to consider how the VM is protected itself, how an application interacts with data to determine during 'motion' if someone should not be accessing the data even though they are already supposedly allowed to do so. Keys are in memory, so therefore you need to guard memory access for those keys to only the application in question. This is the hard part, and requires you to think seriously about logging, key management, etc.
So really what are you trying to achieve?
Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009-2015
Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.
Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast

Similar Messages

I can easily by-pass into phone by using camera on lock screen

i just updated my iphone4s to 7.0.4.i can easily by-pass into phone by using camera on lock screen ,is there any recovery??

Yes that is correct - BUT you cannot get onto the phone itself without Passcode or Fingerprint if you have that set up..

Can we create the Purchase order that using P&L account or just using account do not use cost center.

Dear Experts,
Could you please advise :
1) Can we create the purchase order that using profit and loss account ? ( if yes , which kind of account assignment category we should use ?)
2) How to create a purchase order for service charge .( just using GL account )
Thanks & Best Regards,
Watson

Hi,
   May I know why you do not use cost center for consumption?
   You may create a new account assignment category in OME9 by copying K and maintain the cost center as optional. Please note that you have to maintain the item category blank and the account assignment category combination in OMG0. Now, you can use a GL account in PO which doesnt require a cost center assignment (in OBC4 against the field status group of the GL)
   You may use the same account assignment category created in the previous step with item category D, after you maintain the combination of the account assignment with item category D in OMG0.
    Please test the scenario and revert back.
Regards,
AKPT

Anyone using SecureDoc Full-Disk Encryption for Mac from WinMagic?

Currently I am using Mac OS X v10.5 on a MBP and want to upgrade to Snow Leopard. I use PGP full disk encryption.
I do not want to wait anymore for PGP v10 before I can upgrade to Snow Leopard. In my search for a replacement for PGP I found SecureDoc Full-Disk Encryption for Mac from WinMagic.
https://www.winmagic.com/products/full-disk-encryption-for-mac
They claim to be Snow Leopard compatible
https://www.winmagic.com/kw/download.php?url=/datasheets/securedocmac_brochure20090925a.pdf
I have two questions:
1) Does anyone have experience with SecureDoc Full-Disk Encryption for Mac from WinMagic?
2) Where can I buy one? PGP has a store where I ordered my copy of the software. But I can't find a store anywhere for SecureDoc. With some trouble I found a reseller in the Netherlands, but they don't reply to any questions.

I am currently testing a trial license from Checkpoint Full Disk Encryption.
http://www.checkpoint.com/products/datasecurity/pc/index.html
The company where I work is a Checkpoint reseller, and normally only has dealings with other companies, not end users. But we arranged a trial license and I can buy a single user license Checkpoint Full Disk Encryption if the test proves Checkpoint Full Disk Encryption is a good solution.
I created a bootable usb disk with Snow Lepoard on it. But I was unable to install FDE on it. After reboot I only get a blank screen, that's it. Probably it isn't supported to boot from a full disk encrypted removable drive, I can understand that.
I can't create a virtual Snow Leopard machine (legal reasons) to test it on. And all FDE solutions I found aren't compatible with Mac Server, which is a shame because you can virtualize Mac Server legally.
So now I am planning to change the hard-disk of my MBP this evening with another hard-disk to test Checkpoint FDE there. I don't want to upgrade my current Leopard installation to Snow Leopard only to discover it doesn't work as expected. I could of-course use my current installation and when it doesn't work rollback to a timemachine backup, but before that I have to decrypt my disk and uninstall PGP witch will take 1-2 days, and encrypt again when the test is over. Not pratical.
I will let you know how the test with Checkpoint Full Disk Encryption went!

DTP plugin can't connect to 10g DB that uses SERVICE_NAME instead of SID

Hi,
I am trying to set up a connection to a database that uses a service name instead of a SID (see below for the TNSNAMES entry. It gets an ORA-12505 error because the listener does not know of SID given in connect descriptor. The Connection descriptor used by the client was:
tdc-sun-77-vip.unix.tdc.xxxyyy.com:1521:SRV_TMS_TNV.
My understanding is that the url for JDBC for service name should use a "/" instead of a ":" to separate the port from the service name. The dialog for creating the connection in SQL Developer has radio buttons to choose between SID and Service Name, so it can generate the url appropriately. The wizard for the Eclipse plugin does not have this option and the plugin always uses a ":" as the separator.
If anyone else has encountered this and gotten around it I would appreciate knowing how.
I am using the Oracle Database Tools 1.2.0.200907171332 for Eclipse Galileo.
Thanks... Bob
AMR01TNV_TMS =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = tdc-sun-77-vip.unix.tdc.xxxyyy.com)(PORT = 1521))
(ADDRESS = (PROTOCOL = TCP)(HOST = tdc-sun-78-vip.unix.tdc.xxxyyy.com)(PORT = 1521))
(LOAD_BALANCE=ON)
(FAILOVER=ON)
(CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = SRV_TMS_TNV)
(FAILOVER_MODE=
(TYPE=select)
(METHOD=basic)
)))

Still broken after two years. Oracle Database Tools version 1.7.2.20110330204, part of OEPE 11.1.1.7.2. Using Oracle Thin Driver ojdbc14 for 10.2.0.2.
(1) Change to Database Development perspective.
(2) In Data Source Explorer, right click Database Connections. Choose Connection Profile Oracle Database Connection.
(3) Name: OEPE Is Broken
(4) Description: Service Names Are Not Supported.
(5) Click on the icon to the right of Drivers: Oracle Thin Driver. This allows one to edit the driver definition.
(6) Change ConnectionURL to 'jdbc:oracle:thin:@server:1521/servicename. This will prove that the plug-in is not using the driver definition as a template.
(7) Use SQL Developer to probe your database. Ensure that the database is one that requires a service name and cannot connect using a SID.
(8) In the "New Connection Profile" dialog....
SID: (try a service name for a database that requires it)
Fill in Host, Port number, User name, and Password.
Note that the ConnectionURL contains a colon instead of a slash in front of the service name. The plug-in seems to be using the colon.
(9) Test Connection
java.sql.SQLException: Listener refused the connection with the following error:
ORA-12505, TNS:listener does not currently know of SID given in connect descriptor
The Connection descriptor used by the client was:
ac4-xxxxx-007-v.ysm.ac4.yahoo.com:1521:acxxxxx.ysm.ac4.yahoo.com
(10) Maybe Test Connection does not work and the plug-in is functional. Click on Finish. No, not the case.
(11) Maybe SID should be

Where can I find the "genre" selections that used to available? Such as Salsa, Holiday, Sports music, etc?

I am trouble locating the section that contained different albums...such as Holiday Music, Songs for Bachelorette parties, etc. Can someone please tell me where I can find them in the Itunes store?
TIA!

Okay...I have some more information and perhaps we are getting closer. On the 250GB, first I went into that disk and used Disk Utilty to re-format it once using Mac OS Extended (Journaled) then a second time, zeroing it out. I did a screen shot to review if needed, and both times it looked perfect...249GB available. Then I went into the Time Machine preferences to get ready to backup again, and it had not excluded the other external 120GB with iTunes so I excluded it. I may has previously, never noticed in that screen that it takes a bit of time for it to calculate the information to save. I may have just clicked on it quickly without reviewing it first. Today I did, and gave it time to calculate. At one point the actual 250GB itself, showed up and I excluded it too like the 120GB. After it finished, the calculations are still it wrong - claiming it has a 200GB backup when the iMac either contains 150GB (based on when I do Get Info) on it or from OmniDisk which calculated about 100GB. I have not allowed Time Machine to do a backup yet, until this discrepancy can be clear.
One thing that I thought I had seen or reviewed previous on the Time Machine settings was my home folder - I could be wrong but wanted to mention that. Another little tidbit to ponder an well is that I have a files of icons that I use for the Hard Disks, and a few folders where I Get Info on the Icon and on the destination and just cut and paste. I did that today to the 250GB after zeroing, but while I was in the Time Machine settings the change was deleted and neither the manufactures icon was there nor mine, and it has the default blue-green one the software uses. I know, because my sister's is that way on her system-unchanged.
Feedback?

How Can insert the records into Excel_sheet by using SQL Task-SSIS ?

As per requirement ,
insert the records in excel sheet(DT) by using SQL Task-SSIS .
I used SQL query in SQL Task-SSIS:
e.g.., INSERT INTO [DT$B1:B1] VALUES ('COMMM')
but error:Executing the query "INSERT INTO [DT$B1:B1] VALUES ('COMMM') " failed with the following error: "This table contains cells that are outside the range of cells defined in this spreadsheet.". Possible failure reasons: Problems
with the query, "ResultSet" property not set correctly, parameters not set correctly, or connection not established correctly.
Please any suggestion ...
-MADHU

then first create a table inside Excel sheet based on your source data. You can Execute sql task for that using excel connection. then use insert to populate it
see an example here where I create a dynamic sheet using execute sql task
http://visakhm.blogspot.in/2013/09/exporting-sqlserver-data-to-multiple.html
Please Mark This As Answer if it helps to solve the issue Visakh ---------------------------- http://visakhm.blogspot.com/ https://www.facebook.com/VmBlogs

How can i replace an apple id that uses a gmail account with my icloud address?

Greetings,
I have an Apple ID that uses a gmail address, which i used to create an iCloud email account. However, I cannot seem to replace my gmail Apple ID with the iCloud address. Is it possible to separate the iCloud email from the gmail address, and make it my only Apple ID i.e. can i scrap the gmail ID and only use my iCloud username as my ID?
Kim

I'm afraid you can't do this. You can change the ID to another non-Apple address, but you can't make your @icloud.com address the ID.

Can you share photos between machines that use the same wifi network? Thanks for your help.

Can you share photos on i-photo between machines that use the same network or even between different accounts on the same machine? I know you can share music on i-tunes but can you do the same on i-photo? Thanks for your help.

Yes.
If you want the other user to be able to see the pics, but not add to, change or alter your library, then enable Sharing in your iPhoto (Preferences -> Sharing), leave iPhoto running and use Fast User Switching to open the other account. In that account, enable 'Look For Shared Libraries'. Your Library will appear in the other source pane.
Any user can drag a pic from the Shared Library to their own in the iPhoto Window.
Remember iPhoto must be running in both accounts for this to work.
You can figure out using it with another machine from that too

How can I build a LabView application that uses the 2012 runtime, on a development system with LabView 2013 or 2014 installed?

I need to build a LabView application .exe to run with the 2012 Runtime, for legacy support. I currently have LabView 2013 installed on my development system, and have 2014 available. How can I build an application that uses the 2012 runtime on this development system? Do I have to downgrade to 2012? Thank you.

We have existing customers that have installed our application that was originally built with 2012 (provided by a contractor that is no longer available). Due to IT regulations, it is far easier to update these customers by simply replacing the .exe file, than creating an install that their IT department must run.
If I have to downgrade to LabView 2012, where can I get the installation for this?

How can you make an smart playlist that uses another smart playlist when I can't see them all

My whole family uses itunes. I want to make a playlist that uses other playlist. However, when I start a smart playlist and click playlist is I get a dropdown menue that doesn't show all my playlists. My wife's name happens to start with a V so all of hers are at the bottom and don't show up.

Once the list of playlists is on your screen you can use the Page Down/Page Up and Arrow Down/Arrow Up keys to access values that aren't shown.
tt2

Can I cluster a web app that uses Spring and iBATIS?

I have a web app that uses Spring and iBATIS. It runs great on a single server. I am now trying to get it to run in a cluster. I went through the code and made all the classes serializable. Also, I added the distributable tag to the web.xml. I then deployed it to two clustered app servers.
When I logon and use the web app, everything goes well. Then, as a test, I determine which app server is being used and stop the web app on it. As I try to continue my session, the following exceptions are generated from the other node:
java.lang.IllegalArgumentException: No SqlMapClient specified.
The exception is being thrown from the Spring code. Is there something else I need to do to get Spring and iBatis to work in a clustered environment.
Also, I see a lot of references to Terracotta as a clustering solution. Will Terracotta work with Oracle App Server?

Thanks for the response.
I think my session information is being shared. I've configured the default application in my OC4J configured for peer-to-peer clustering. Before I did this, if I shut down the instance I was using, it would fail-over to the other application server but my session would be gone and I would be forced to logon again. But once I was logged on, everything ran smoothly.

How can I retreive the buzzword documents that used to be on my account?

I haven't used Acrobat.com in a while (maybe 4 years) and I was wondering if my absence has caused my previous files that used to be on my account to be deleted or removed, or something. I'm not sure if the version of Acrobat.com that I used was overwritten or updated. I would really like to access these documents. Is there any way. I would appreciate a response. Thank you.

Hi dib-dab,
Workspaces (the Acrobat.com that you're familiar with) is being retired early next year. But, you should still be able to retrieve your Buzzword files, and then store them on the new Acrobat.com. For more information, please see: FAQ: Adobe Workspaces retired
I hope that helps.
Best,
Sara

Hacker Breaks Into Sony PlayStation Network

The Japanese electronics giant Sony has admitted millions of PlayStation network gamers may have had their personal details stolen.
A hacker broke into the PlayStation video game online network and stole names, addresses and possibly credit card data belonging to 77 million people.
It is believed to be one of the biggest-ever internet security breaches of its kind.
Sony learned of the breach on April 19 and immediately shut down the PlayStation network, but kept quiet about it for a whole week.
In a statement the company said an "illegal and unauthorised person" obtained people's names, addresses, email address, birthdates, usernames, passwords, logins, security questions and more.
full story - http://uk.news.yahoo.com/5/20110427/twl-hacker-breaks-into-sony-playstation-3fd0ae9.html
-+-No longer a forum member-+-

Soo glad im an xbox user.
Unlucky, executives did bow for a long time for those who will accept the apology:
http://uk.news.yahoo.com/5/20110501/twl-sony-execs-bow-in-apology-at-playsta-3fd0ae9.html

Can you install Panther on an eMac using retail disks?

I've had problems in the past installing Panther onto an eMac using retail disks.
is there a problem doing this??
past issue - once installed, and booting for the first time, the screen on the eMac would only show the center 50%, the cursor would not go outside of it but there were buttons and icons outside of it. i had to install from the eMac disks and then upgrade to server. (i was doing a OS X Server install onto an eMac then)
current issue - i can't boot from the Panther disk 1!!! checking to make sure it is not the disk..... my client was in the middle of installing Panther, and in the middle of disk 1 it froze and i think gave a KP based on his report of what happened.
thanks
bob

When you get the blinking mac face/question mark when booting, this means that your machine can't find the startup disk it's looking for - whether cd or hard drive. After a moment, it then searches until it finds any startup disk. You can lose your Classic - OS9, while doing operating systems loads if you don't restore it from your original system disks that came with your machine. There may be problems trying to go back to 10.2 from 10.3. It's not a problem I've had, but someone was telling me that the major upgrades (Jaguar to Panther) may have firmware updates that aren't compatible if you try to reload the older OS. It's best to install Panther, then reinstall your applications from the original disks that came with your machine.

Can host hacker break into guest that uses full disk encryption?

Similar Messages

Maybe you are looking for