{"id":1358,"date":"2010-07-12T07:00:07","date_gmt":"2010-07-12T15:00:07","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=1358"},"modified":"2010-07-12T07:00:07","modified_gmt":"2010-07-12T15:00:07","slug":"security-disposable-vms-for-tighter-security","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/security-disposable-vms-for-tighter-security\/","title":{"rendered":"Security: Disposable VMs For Tighter Security"},"content":{"rendered":"

A new flavor of the Linux Operating System is now available that might prove to be one of the strongest defenses put up against malware. \u00a0 The new Operating System is called Qubes<\/a>, and it is a combination of Linux with the Xen Virtual machine. \u00a0 Qubes is the invention of Joanna Rutkowska<\/a>,\u00a0a Polish researcher of malware and exploits. \u00a0Rutkowska is famous for a paper she authored and presented at a Black Hat conference in 2006 that described a technique called \u00a0‘Blue Pill’<\/a> for moving a running OS into a virtual machine using hardware virtualization.<\/p>\n

Rutkowska has released an alpha version of the new operating system Qubes<\/a>. \u00a0The idea of Qubes is that every instance of an application will start in its own lightweight virtual machine and get thrown away once the application shuts down. \u00a0In this way, every application running on the machine is in its own sandbox and is isolated from every other application. \u00a0This approach is called ‘security by isolation’. \u00a0If the application in one sandbox downloaded malware, the affects of that malware would be limited to only the virtual machine that application is running in.<\/p>\n

Security by isolation differs from standard approaches taken in combating malware. \u00a0 But it has many analysts <\/a>intrigued and predicting that this approach and way of thinking about how to architect an operating system is sure to become more popular.<\/p>\n

Qube’s lightweight per-app Virtual Machines are called AppVMs. \u00a0 Qube also supports a technique for being able to securely copy data between the AppVMs as well as to share files among all of them. \u00a0Qube virtualization makes it appear as if all the AppVMs represent tha applications of a single user desktop.<\/p>\n

Security researcher Dino Dai Zovi <\/a>wrote that “the desktop analogue to the network firewall is the privilege separated and sandboxed application. \u00a0These mechanisms finally move the bull (untrusted data) from the china shop (your data) to the outside where it belongs (a sandbox). \u00a0While it doesn’t quite reduce the attack surface, it significantly raises the bar for an attacker through defense-in-depth. \u00a0If an attacker is able to exploit a vulnerability and execute code, they must then exploit another vulnerability in the sandboxing mechanism in order to break free and even read the user’s data.”<\/p>\n

Sandboxing applications with an Operating System like Qube does look like a promising idea for advancing security, but is sure to bring with it challenges for writing secure applications that must play by these new rules.<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

A new flavor of the Linux Operating System is now available that might prove to be one of the strongest defenses put up against malware. \u00a0 The new Operating System is called Qubes, and it is a combination of Linux…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-1358","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/1358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=1358"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/1358\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=1358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=1358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=1358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}