Hyperjacking Explained

Hyperjacking is an attack in which a hacker takes malicious control over the hypervisor that creates the virtual environment within a virtual machine (VM) host.^[1] The point of the attack is to target the operating system that is below that of the virtual machines so that the attacker's program can run and the applications on the VMs above it will be completely oblivious to its presence.

Overview

Hyperjacking involves installing a malicious, fake hypervisor that can manage the entire server system. Regular security measures are ineffective because the operating system will not be aware that the machine has been compromised. In hyperjacking, the hypervisor specifically operates in stealth mode and runs beneath the machine, making it more difficult to detect and more likely to gain access to computer servers where it can affect the operation of the entire institution or company. If the hacker gains access to the hypervisor, everything that is connected to that server can be manipulated.^[2] The hypervisor represents a single point of failure when it comes to the security and protection of sensitive information.^[3]

For a hyperjacking attack to succeed, an attacker would have to take control of the hypervisor by the following methods:^[4]

• Injecting a rogue hypervisor beneath the original hypervisor
• Directly obtaining control of the original hypervisor
• Running a rogue hypervisor on top of an existing hypervisor

Mitigation techniques

Some basic design features in a virtual environment can help mitigate the risks of hyperjacking:

• Security management of the hypervisor must be kept separate from regular traffic. This is a more network related measure than hypervisor itself related.
• Guest operating systems should never have access to the hypervisor. Management tools should not be installed or used from guest OS.
• Regularly patching the hypervisor.

Known attacks

As of early 2015, there had not been any report of an actual demonstration of a successful hyperjacking besides "proof of concept" testing. The VENOM vulnerability was revealed in May 2015 and had the potential to affect many datacenters.^[5] Hyperjackings are rare due to the difficulty of directly accessing hypervisors; however, hyperjacking is considered a real-world threat.^[6]

On September 29, 2022, Mandiant and VMware jointly made public their findings that a hacker group has successfully executed malware-based hyperjacking attacks in the wild,^[7] affecting multiple target systems in an apparent espionage campaign.^{[8] [9]} In response, Mandiant released a security guide with recommendations for hardening the VMware ESXi hypervisor environment.^[10]

See also

• Blue Pill attack
• Qubes OS
• Virtual machine escape

Notes and References

1. Web site: HYPERJACKING. Telelink. 27 February 2015. https://web.archive.org/web/20150227174207/http://itsecurity.telelink.com/hyperjacking/. 27 February 2015. dead.
2. Web site: Gray. Daniel. Hyperjacking - Future Computer Server Threat. SysChat. 27 February 2015.
3. Web site: Ryan. Sherstobitoff. Virtualization Security - Part 2. Virtualization Journal. 27 February 2015.
4. Web site: Sugano. Alan. Security and Server Virtualization. WindowsITPro. 27 February 2015. https://web.archive.org/web/20150227184936/http://windowsitpro.com/virtualization/security-and-server-virtualization. 27 February 2015. dead.
5. Web site: VENOM Vulnerability. CrowdStrike.com. 18 October 2016.
6. Web site: Common Virtualization Vulnerabilities and How to Mitigate Risks. Penetration Testing Lab. 25 February 2013 . 27 February 2015.
7. Web site: Marvi . Alexander . Koppen . Jeremy . Ahmed . Tufail . Lepore . Jonathan . Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors . Mandiant Blog . 30 September 2022 . https://web.archive.org/web/20220930032926/https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence . September 30, 2022 . September 29, 2022 . live.
8. Greenberg . Andy . Mystery Hackers Are 'Hyperjacking' Targets for Insidious Spying . Wired . 30 September 2022 . https://web.archive.org/web/20220930032547/https://www.wired.com/story/hyperjacking-vmware-mandiant/ . September 30, 2022 . September 29, 2022 . live.
9. Web site: Hardcastle . Jessica Lyons . Covert malware targets VMware shops for hypervisor-level espionage . The Register . 30 September 2022 . https://web.archive.org/web/20220930032710/https://www.theregister.com/2022/09/29/vmware_malware_mandiant/ . September 30, 2022 . September 29, 2022 . live.
10. Web site: Marvi . Alexander . Blaum . Greg . Bad VIB(E)s Part Two: Detection and Hardening within ESXi Hypervisors . Mandiant Blog . 30 September 2022 . https://web.archive.org/web/20220930024445/https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening . September 30, 2022 . September 29, 2022 . live.