Neocleus secure access

TalkBack 1 of 2:

Next »

• Thread View
• Flat View

Neocleus is not secure

Neocleus security architecture is flawed at its basic level. The architecture uses a software mechanism to provide direct physical device assignment to virtual machines, such as graphics cards and wireless networks. It does not support hardware based direct I/O assignment or hardware based IOMMU, it is known on Intel platform as VT-d technology. Instead Neocleus engineers came up with their own software based scheme, known in the Xen community as 1:1 mapping (http://www.xen.org/files/xensummit_4/Neocleus_HVM_PCI_Pass-through_Zana.pdf). Their scheme provides software based IOMMU, which is inherently flawed in its security model. An errant DMA transfer in one virtual machine is capable of writing into the memory of another virtual machine ? can you say, ?no more memory protection or isolation between virtual machines?? Given this huge security flaw, it would take no time to write a key stroke logger or denial of service attack against any VM running on this device. The only way to achieve true security and reliability between multiple virtual machines sharing the same piece of hardware is to use hardware support for direct assignment or VT-d, any other solution is not secure.

Posted by: DavidRottenberg   Posted on: 09/25/08 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now