Virtualization Security

Thursday, October 25th, 2007

Theo de Raadt on virtualisation security:

> Virtualization seems to have a lot of security benefits.

You’ve been smoking something really mind altering, and I think you
should share it.

x86 virtualization is about basically placing another nearly full
kernel, full of new bugs, on top of a nasty x86 architecture which
barely has correct page protection. Then running your operating
system on the other side of this brand new pile of shit.

You are absolutely deluded, if not stupid, if you think that a
worldwide collection of software engineers who can’t write operating
systems or applications without security holes, can then turn around
and suddenly write virtualization layers without security holes.

> Anything we can do to increase security, *including* setting up VMs (of any
> flavor) is an improvement [that also increased hardware utilization].

This last sentence is such a lie.

The fact is that you, and most of the other fanboys, only care about
the [that also increased hardware utilization]. The yammering about
security is just one thing — job security. You’ve got to be able to
sell increased harwdare utilization in a way that does not hang you up
at the end of the day.

Of course, de Raadt is right… in his own tiny little world at least. Running services which would normally run on multiple machines on multiple hypervisored instances on a single host machine would indeed be less secure than running them from multiple physical machines.

But running multiple applications on virtualized machines which would normally run on a single machine is more secure, simply because it adds another layer of protection.

But, as usual, de Raadt’s complete ineptitude when it comes to communications totally negates any point he’s trying to make and only serves to rile up people against his cause.

It’s the chrooted story all over again. Yes, chroot isn’t completely secure. Yes, chroot isn’t meant as a security construction. Yes, running multiple services on a single machine that would normally be run on several separate physical machines is less secure. That doesn’t mean chroot (and virtualisation for that matter) can’t add an extra layer of security if used properly!

Theo de Raadt’s problem is that he views security the way cryptography experts view cyphers: as an absolute. But security isn’t like math. It’s not absolute. There are right and wrong ways of doing security. De Raadt is like that security consultant who says: “You must have randomly generated passwords consisting of at least eighteen characters, lower and upper case, numbers and symbols, nothing repeated twice, completely unique and changed every week, or your being insecure!”, all the while ignoring the fact that that kind of password policy will only force people to write down passwords on a yellow-note under their keyboards. In theory, they’re right. In practice, they’re wrong. These people become blinded by their own viewpoint. Just as these so-called security consultants are blinded by their belief that strong passwords equal security, so is Theo de Raadt blinded by his belief that virtualization doesn’t improve security.

Perhaps it’s time to stop listening to de Raadt, and start listening to people with a broader overview of the situation.