Virtual Machine Saved State Security in Hyper-V and VMware #winserv #hyperv #itpro #vmware #vmworld
During a recent virtualization event, an IT Pro posed a question regarding virtual machine saved state security in Hyper-V:
Q: I read an article where a non-administrator was able to access VMware files such as the virtual machine disks and the virtual machine saved state and then able to view the in memory contents of the VM such as passwords.
The article is here:
I’m concerned about who has access to what virtual machines files and wondering about Hyper-V. Should I be concerned?
For the official answer, we went straight to Jeff Woolsey, Principal Program Manager on the Windows Server & Cloud Team. Below is Jeff's answer:
A: No. After 10+ years of Trustworthy and the Secure Development Lifecycle (SDL), Microsoft designs, develops and tests its products to be secure by default. In the blog post using VMware, a non-administrator is able to access the virtual machine’s files such as the in memory state (the saved state) of the virtual machine itself. The Hyper-V team long understood this could be an attack vector and ensures that Hyper-V ships secure be default. Specifically, the attack depends on reading the contents of .vhd/.vhdx files on the host with a non-administrative privilege.
This simply isn’t possible in Hyper-V without an administrator delegating access.
In ALL versions of Hyper-V, going back to the initial release of Hyper-V for Windows Server 2008, the guest data files are ACL’ed for: System Administrators and for the Specific VM. In Windows Server 2012, there is a new Hyper-V Administrators group, however, users need to be delegated access to this group by an administrator. By default, there are no users in this group. Thus, in Hyper-V a non-administrative account on the machine will NOT have permissions to read the .vhd/.vhdx files in the first place. This is secure by default.
HTH,
Keith