Welcome back to vSphere 8 in the real world. Now we're going to discuss examples of security concerns in the real world.
So you can get a list of different security advisories that are out from VMware on their website.
You can go to VMware.com slash security dash slash advisories dot html.
There's also a lot of other third-party sites out there.
A lot of security vendors out there will have a section where new vulnerabilities for different products like VMware or Windows or Linux kernel, different things like that are all available.
This one is specific to obviously for VMware.
An example here is like they're saying that here's a vulnerability.
An open SLP is used in EthicsEye has a use after free issue.
So a use after free means that an application developer wrote a program that says, okay, dynamically as we're running, we're going to go and grab RAM, allocate RAM to the application when we need it.
And when we're done, we're going to release that RAM and free that up and remove it from being allocated to the application.
And they did the first part.
They did go in and they did allocate the RAM to the application.
They didn't release the RAM when they were done.
The memory is still associated with that application.
And there is ways of, you know, for bad actors to go in and take advantage of these memory spaces that are allocated to applications.
And the application is not really using it anymore.
And they can inject information into it and then try and get the application to execute it, right?
So the solution to working around it to make this, you know, not a vulnerability for your EthicsEye host is to apply the newest patches for this.
Keep your EthicsEye host up to date and patched.
And this vulnerability has been patched.
It has been resolved, okay?
So there's another vulnerability out there where malicious actors can access virtual machines that are using 3D graphics enabled, right?
And they're actually able to execute code on the hypervisor through the VM through this 3D graphic enablement.
And a way that you can resolve that is to patch your host.
That issue has already been patched.
It's already been released.
And it's no longer an issue if you have a currently updated and patched EthicsEye host.
So what you might notice here is that, you know, which is a couple of examples.
And the list is very, very long.
There are a lot of vulnerabilities that have occurred to the EthicsEye hypervisor like any operating system and maybe fewer to EthicsEye than a lot of them.
But they all have their fair share.
Windows has their fair share.
Even Mac has theirs.
Linux gets, you know, vulnerabilities out there all the time.
The issue is how quickly can we find patches for these, can we release, you know, and test patches for things like this.
Keep your systems patched.
The only thing that really you can't, you know, protect by patching against is what are called zero-day exploits, right?
Zero-day means that this is out in the wild and it's not been discovered by the vendor yet necessarily, right?
So when they first, first discover it before they patch for it, this is when we're done zero-day.
But they will quickly release, hey, we have this problem.
Here's a temporary fix to work around it possibly.
Stop this service.
Don't use this feature or something like that until they have a patch.
Then they'll say, okay, and now we have this patch.
Install the patch.
And now you can enable this service or you can use this feature or, you know, something like that.
VMware has a feature if you're using their NSX product that's called virtual patching.
It's actually super cool in that if you know a program like SQL has a vulnerability,
and Microsoft has released a patch for that vulnerability,
or maybe they haven't got to a patch and VMware is aware of it,
they can actually in the hypervisor level through their hypervisor firewall, that NSX, do what they call virtual patching.
So when they see traffic going that looks like it's going to be attacking a vulnerability on an unknown application,
they can block it.
That's a pretty cool thing.
Then when you have time to actually reboot the VM and, you know, shut it down and reboot it, that kind of thing,
then you can do the real patching.
That's pretty cool that they have that.
But as far as the ESXi hosts go, keep them patched.
When VMware releases updates, do your patching.
Schedule your patching.
Keep your systems patched.
And most likely you'll be far, far less likely to get hit with a vulnerability.
Most hackers out there honestly aren't very creative.
They're using kits and this and that.
There are some bad actors out there that are governments, you know, things like that.
And they're really, you know, great at what they do.
And they may even be inventing zero-day exploits.
But the majority of them out there in the wild are actually just using, like, scripts and, you know, different things like that.
And they're buying packages that have, you know, ability to exploit vulnerabilities, which means they've been out there for a while.
And a lot of these vendors are already patched against that.
And what they're doing is they're hoping that you haven't patched your systems.
And if you haven't patched your systems, then they can exploit these vulnerabilities still.
And because so many people don't patch, you know, frequently enough, often enough, and keep their systems current anywhere near enough,
they actually still hit a lot of people who are vulnerable.
But to avoid that, keep your systems patched, patched, you know, frequently patched.
You know, when new patches come out, don't wait months and months to do it.
Keep that kind of thing happening all the time.
And your system will be much, much more hardened than systems that are, like, you know, three or four or five or six months out of date for patching.
So keep your systems patched, and you'll keep your systems far more secure.
All right.
So we discussed some examples of some issues with VMware security.
And the real takeaway here is keep your systems current and keep them patched.