{"id":12509,"date":"2012-04-27T13:35:36","date_gmt":"2012-04-27T12:35:36","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=12509"},"modified":"2012-04-27T13:35:36","modified_gmt":"2012-04-27T12:35:36","slug":"why-hyper-v-fixed-vhd-creation-takes-so-long-preventing-a-genuine-security-risk","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=12509","title":{"rendered":"Why Hyper-V Fixed VHD Creation Takes \u201cSo Long\u201d \u2013 Preventing A Genuine Security Risk"},"content":{"rendered":"

Every now and then I hear someone complaining about how long it takes to create a fixed VHD\/VHDX.  There\u2019s a very good reason, as this story on NetworkWorld<\/a> shows:<\/p>\n

\n

A forensic IT study by a U.K. security consultancy found that some multi-tenant public cloud providers have "dirty disks" that are not fully wiped clean after each use by a customer, leaving potentially sensitive data exposed to other users.<\/p>\n<\/blockquote>\n

FYI, AFAIK most of the mentioned companies are using some variant of Xen or vSphere.  The issue here is that Customer A buys a VM and uses it to store data in a virtual disk.  That virtual disk is a file that is stored on physical disk.  Customer A eventually decommissions the VM or their storage is relocated.  Now think about what a delete really is; it\u2019s not a secure delete.  Deleting a file simply removes the entries from the file system table.  The 1\u2019s and 0\u2019s are still there, waiting to be read.<\/p>\n

Now along comes Hacker B who buys a VM and deploys it.  Their VHD is placed over the same location of physical disk as Customer A\u2019s old VM.  Without any security measures, Hacker B can simply run a disk scan tool, from within their VM, and find those 1\u2019s and 0\u2019s, pretty much doing some disk forensics to restore the \u201cdeleted\u201d data that Customer A previously stored in their VM.  And that\u2019s exactly what that study found was possible with a number of public cloud<\/a> providers:<\/p>\n

\n

\u2026 Rackspace and VSP.net had the vulnerability.<\/p>\n<\/blockquote>\n

The Microsoft developers VHD\/VHDX were aware of this and took measures to prevent it.  When you create a VHD\/VHDX it securely wipes the contents of the file as it is created.  This prevents access to data that was previously on the underlying physical disk.  Disk forensics will get you nowhere.<\/p>\n

A number of 3rd party tools are out there to instantly create fixed VHDs but they fail to implement this secure wipe so the process can be speeded up, thus putting the hosting company at risk of this threat.  In this case, it is a matter of balancing a genuine security risk (especially in a public cloud) versus performance (of deploying new virtual machine storage while the customer watches a progress bar on a web portal).<\/p>\n

The story continues to report that the mentioned affected hosting companies resolved the issue after they were informed.<\/p>\n

Technorati Tags: Hyper-V<\/a>,Virtualisation<\/a>,Cloud Computing<\/a>,Security<\/a>,Storage<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

Every now and then I hear someone complaining about how long it takes to create a fixed VHD\/VHDX.  There\u2019s a very good reason, as this story on NetworkWorld shows: A forensic IT study by a U.K. security consultancy found that some multi-tenant public cloud providers have "dirty disks" that are not fully wiped clean after … Continue reading “Why Hyper-V Fixed VHD Creation Takes \u201cSo Long\u201d \u2013 Preventing A Genuine Security Risk”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[20],"tags":[59,181,190,99,195],"class_list":["post-12509","post","type-post","status-publish","format-standard","hentry","category-hyper-v","tag-cloud-computing","tag-hyper-v","tag-security","tag-storage","tag-virtualisation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t