CTEC5803: Host and Network Security Vulnerability Report

This report focuses on the Hyperjacking vulnerability within the context of host and network security, a critical concern for organizations. It begins by defining Hyperjacking as a malicious control over a hypervisor, targeting the underlying operating system. The report delves into the underlying flaws, discussing Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) databases, highlighting the importance of proactive vulnerability management. It then details the method of launching a Hyperjacking attack, including rogue hypervisor injection and gaining control. The report further explores detection methods, such as IP timestamp exploitation and machine learning techniques using memory snapshots. Finally, it outlines countermeasures to mitigate the risks associated with Hyperjacking, emphasizing the need for robust security measures. The report concludes by underscoring the importance of vigilance and proactive security practices to protect against this sophisticated threat.

Running head: HOST AND NETWORK SECURITY
HOST AND NETWORK SECURITY
Name of the Student:
Name of the University:
Author Note:

1HOST AND NETWORK SECURITY
Table of Contents
Introduction:....................................................................................................................................2
Hyper jacking...................................................................................................................................2
The underlying flaw.........................................................................................................................3
Method of launching the attack.......................................................................................................5
Detection of the attack.....................................................................................................................6
Countermeasures of the attack.........................................................................................................7
Conclusion.......................................................................................................................................8
References........................................................................................................................................9

2HOST AND NETWORK SECURITY
Introduction:
Security of information is becoming one of the greatest priority for every organization.
The network of an organization or users should be strongly protected such that it become
difficult for the attacker to breach the data. The increasing trend of security threats is due to the
internet and its structure. The security is important for a user system because it protects the assets
of the users or company, it helps in achieving competitive advantage, it also helps in complying
the regulatory needs as well as fiduciary responsibilities and so on. The exploit chosen for this
report is “Hyper jacking”. The report directly focuses on the virtualization vulnerabilities. The
report also tries to increase the importance of the virtualization in the society. The report briefly
describes the underlying flaw of hyper jacking, method of launching the hyper jacking attack,
methods by which the attack can be detected and lastly it describes the countermeasures to
prevent the risk.
Hyper jacking
It is a kind of attack where a hacker achieves a malicious control on the hypervisor which
generates the virtual environment in the virtual machine host. The attack is carried out to target
OS which is lying beneath the Virtual Machine such that the hacker can execute the applications.
It deals with installing malicious and fake hypervisor which can handle overall server system of
a user or of an organization. A successful known hyper jacking attack is the VENOM
vulnerability which occurred in May 2015.

3HOST AND NETWORK SECURITY
The underlying flaw
Common Weakness Enumeration (CWE) must do with proper vulnerabilities which are
not the instance within systems and products. On the other hand, Common Vulnerabilities as
well as exposures has to do with specific instance within a product and a system. The process of
CVE is an initiative taken by the National cyber security FFRDC that is managed by different
business organization (Umezawa et al. 2018). This application is mostly done by taking funding
from the homeland security department. This is a database of vulnerability which is identified
against different publically released software packages such as drupal, Jhoomla etc. According to
Jimenez, Le Traon and Papadakis (2018), proper vulnerability strategies are needed to be
developed by the company owners and the developers as well to ensure that the data are secured
from the external attackers. According to Glanz et al. (2015), jaw dropping vulnerabilities in
Drupal can lead to attack. This tool can also perform remote code execution. Nafees et al.
(2017) stated that, the attackers are required to use proper security measures to keep the data
secured from external attackers. The different security mechanisms that a company should use to
avoid hyper jacking include use of application firewall and encryption as well. According to
(Fang, Li and Li 2016), there are different software packages such as Drupal, NodeJS, Oracle
database etc which are facing major security flaws while being used in any organization or
business applications. Mishina et al. (2018) opined that, CVE database does not have any
appropriate risk, exploit information, fixed information etc. The database contains nature of the
flaw, short description and also some additional information based analysis as well. Nafees et al.
(2017) stated that, security focus is referred to as one of the major concern for the business
application, revenue structure and competitive advantages as well. However, CVE list is not a
completely comprehensive flaw list against the available public software package. In addition to

4HOST AND NETWORK SECURITY
this, the researcher or the attackers must not disclose the flaws but should sell those among the
bidder parties or the willing parties. Jimenez, Le Traon and Papadakis (2018) stated that, these
vulnerabilities against different application may become more active however the CVE for that
might not filed for few weeks based on the legal and complexity implications. There are
different vulnerability tools available that claim to be CVE complaints. The CVEs are given to
publically distributed software packages not for any other applications.
O the other hand, CWE is referred to as a project which is directed by MITRE. According to
Umezawa et al. (2018), CWE is not a vulnerability database. According to Glanz et al. (2015),
CWE is a categorized system application for the weakness and vulnerability in software. The
CWE database has a view that is called development concept that is organized based on
weakness that is identified during software development. Mishina et al. (2018) opined that,
several categories are there are under each category several weaknesses are also present that are
needed to be resolved or mitigated.

5HOST AND NETWORK SECURITY
Method of launching the attack
A virtual environment is set up for the successful completion of the integral
functionalities without spending the internal resources and carrying out the entire set of functions
in a virtual operating system that is being hoisted upon the primary operating system.
Technological advancements result into multiple gateways that are exploited by the attackers to
get into the system and cause issues for the organisations that uses such environments for their
functionalities. Several vulnerabilities come up when discussing about the security issues of a
virtual environment. Broadly they are classified into two sections such as Host based security
issues and Network based issues. Many instances have been witnessed till date that are some of
the primary threats or issues faced by the virtual environment. Some of the mentions worthy are
Hyperjacking, VM Sprawl, Offline and dormant VMs and a lot more. This report will describe
about a host based threat of virtual environment and is termed as Hyperjacking.
Commonly speaking, Hyperjacking is hacking a Hypervisor that acts as an integral part
of the hosted virtual environment (Sancheti 2015). Before describing the term of Hyperjacking,
the first thing that have to be described is Hypervisor. A hypervisor is the software that is
responsible for the creation and running of virtual machines in a computer system. The machine
where a hypervisor makes itself functional is known as the host machine and all other virtual
machines that run in parallel are termed as guest machines (Guthrie, Lowe and Coleman 2013).
Hacking of this hypervisor is solely termed as Hyperjacking. Hyperjacking also known as
Hyperjumping takes place when a hacker tries to take entire control over the virtual machine
(Ganesula 2013). Few of the beliefs state that the concept of Hyperjacking is theoretical and it
gets contradicted by the other beliefs that term this process as a disgraceful approach to
compromise the virtual machines or in other words compromising the hypervisor. As a

6HOST AND NETWORK SECURITY
hypervisor behaves as the software layer of the virtual machines hence, this threat or hacking
activity could be classified under host based threats for the virtual environment. The power of a
hypervisor also determines the priority of being hacked. A hypervisor performs its functions
within the main operating system of the host machine and remains underneath it. Hence, this
hypervisor appears to be more attractive to the hackers to take control over. Hacking the
hypervisor will not only make the virtual machines remain under control of the hacker but also it
makes the primary operating system of the host machine to get under the hacker’s control. Thus,
the entire system of the organisation that is using virtual machines for performing its functions
will get under control of the hackers. The performing media of the hypervisor thus makes the
entire system under the threat of being hacked (Guthrie, Lowe and Coleman 2013).. Thus, a
hosting based flaw of the hypervisor makes it even more vulnerable, mostly due to its platform
of execution. Though the process of hyperjacking makes the system vulnerable enough, the
complexity of the process of hacking a hypervisor makes this process as one of the rare cases to
happen for the virtual environment. Hackers, who are highly skilled and provided with enough
resources will be required for this process to take place
The process of hyperjacking takes place in a number of steps. They are as follows:
1. Rogue hypervisor injection underneath the original hypervisor: To gain control over
the original hypervisor, hackers have to inject a rogue hypervisor that is a hypervisor
created to serve the desired intention of the hackers and it will replace the original
hypervisor and will act as the original one. It is somehow alike to the root-kit infection.
The root-kit infection does not directly cause damage to the system. It creates some
hidden channels through which unauthorised codes are dumped into the system without
any knowledge of the administrators (Shahzad and Litchfield 2015). Similarly, rogue

7HOST AND NETWORK SECURITY
hypervisor also creates covert channels through which unauthorised codes are dumped
into the system which cause the damage.
2. Obtaining original hypervisor’s control: As the original hypervisor is replaced with the
rogue hypervisor, hence, all of its control is transferred to the rogue one and the hacker
can enjoy total control of the original hypervisor (Acosta 2018). This leads in causing
damage to the entire system by dumping unauthorised codes into the system by the
hidden or covert channels created by the rogue hypervisor. Thereafter the system gets
under control of the hacker.
3. Running of the rogue hypervisor over the existing one: Due to the creation of the
covert channels the unauthorised codes get sent to the system and thus making the system
work as per the desire of the hacker (Ravishankar and Subramaniam 2015). In addition to
it, the unauthorised codes that get dumped into the system continuously makes the system
to identify the rogue hypervisor as the original one. Thus, this illusion created by the
rogue hypervisor makes it run over the existing one. It leads towards gain of the entire
control of the host system as well as the virtual machines and finally the main operating
system of the machine (Saini and Saini 2014). Finally, the process of hyperjacking gets
installed and hacking of the hypervisor is accomplished.

8HOST AND NETWORK SECURITY
Detection of the attack
Studies by Noorafiza et al. (2013) stated about the exploitation of IP timestamp for the
detection of Hyperjacking. The steps that were followed consists of collection of the IP
timestamps from all of the devices that are connected with the host machines along with other
virtual machines or guest machines as the initial step. This step is followed by the collection of
the IP address and timestamps of maximum four devices and then analysing the timestamp when
the request is being actually made. These timestamps that are analysed for the detection of
hyperjacking clarifies the requests that are made to machine and thus, the detection is done.
Another process that is being suggested by researches and studies is use of machine
learning for the detection of any kind of threat towards the virtual environment (Joseph and
Mukesh 2018). Usage of memory snapshots of virtual machine is said to be effective for the
detection of any kinds of attack over the virtual environment. After the collection of the VM
snapshots, they are classified into two categories such as attacked snapshots and non-attacked
snapshots. The snapshots that are collected get used as a backup that are stored in the backup
servers. Such approaches prove to be helpful for making the VM acquire the quality of self-
healing in case of any attacks caused to that particular VM (Continella et al. 2016), . In the
infrastructure of local cloud, this approach does not let the VM to rely on any supportive backup
VM in the server, which will be definitely compromised in nature, when the system is under any
attack. Thus, no major issues would be generated and the VMs could self-heal them and can get
back to the original functionality and can serve the purpose.
In addition to these systems, another intrusion detection technique that is being suggested
are broadly classified into two sections that is, Network based and host based. The HIDS that is

9HOST AND NETWORK SECURITY
Host based Intrusion Detection System has the feature of high host availability, and would find
whether the system is easier to attack or not and in addition to it a Kernel level HIDS (Snapp et
al. 2017). IDS needs to be monitored whether it crash frequently or not as that makes the system
more vulnerable.

10HOST AND NETWORK SECURITY
Countermeasures of the attack
To prevent hyperjacker from taking control over hypervisor in the aim of gaining access
to the target’s data as well as the VMs, some strategic plans is designed by the security advisors
and researchers. Those are listed below:
 Traffic monitoring related to VM: The opportunity of monitoring the network
traffic of VM backbone is critical. The conventional practices of detection doesn’t
achieve success in this case of VM monitoring (Kuan et al. 2018), as the traffic is
controlled through internal switching. VSphere, VMWare and Hyper-V
implementation of virtualization is used by Veeam One in the aim of examine the
utilization of system and monitoring the resources of network (Raney and Ixia
2017). Some monitoring tools are already designed in the aim of dealing with this
scope, such as: VM Monitor and Virtualization Manager by SolarWinds, PRTG
Network Monitoring by Paessler, LogicMonitor, Quest Foglight etc. those can
work efficiently with MS Hyper-V, Orcale VM, Amazon AWS, and Linux.
 Control by Administration: The security of access and authentication could get
compromised for the happening of VM sprawl and other security issues (Wysopal
et al. 2013). The organization should take effective steps in designing the process
of authentication in their practical work flow, special supervision should be taken
in the case of identification of management (Barak et al. 2016), and the login
procedure to the systems of the organization should be ironclad.
 Security related to Customer: Security issues not only took place on the servers of
organization site, customers or consumers could also be the victim of the hyper
jacking (Hashizume et al. 2013). So proper protection and supervision should be

11HOST AND NETWORK SECURITY
placed at the interfaces that directly interact with the consumers such as link and
websites.
 Segregation of VM: In addition with the practice of normal isolation, to
strengthen the process of security a segregation is done in the functionality of too
(Subramanian and Jeyaraj 2018). For example, a practice of separate zone of
security is designed for the servers as well as the computing machine.
 Installation of antivirus software: Though MIT tries it’s best to prevent the
trespassing or data hijacking, but no computing machine is immune to all of them.
As an improvement to this scenario antivirus software should get installed on the
VM separately, even if protection to the virus is already installed on the operating
system of Macintosh itself. To get further information about the protection of
virus, it is distributed by MIT without any cost charging. Sophos, that is supported
and distributed as a software by IS&T, offers protection against possible threats
and virus, worm, virus and adware as well as spyware. Now a day Windows offer
Windows Defender on the virtual machines of windows in the aim of giving extra
protection.
 Keep updating the OS: It is also important to keep the virtual operating system as
well as the host as the case of compromisation could take place on either type of
the systems. Security system should be updated in a daily basic to keep the
computing system protected from potential vulnerabilities (Lin 2013). As in the
case of VM automatic updating only work at the time of working, and takes a
long time, so manual updating should be practiced as soon as the owner turns the
VM on.