WEBVTT 00:00:00.000 --> 00:00:11.000 Welcome back to vSphere 8 in the real world. Now we're going to discuss examples of security concerns in the real world. 00:00:11.000 --> 00:00:18.000 So you can get a list of different security advisories that are out from VMware on their website. 00:00:18.000 --> 00:00:23.000 You can go to VMware.com slash security dash slash advisories dot html. 00:00:23.000 --> 00:00:26.000 There's also a lot of other third-party sites out there. 00:00:27.000 --> 00:00:37.000 A lot of security vendors out there will have a section where new vulnerabilities for different products like VMware or Windows or Linux kernel, different things like that are all available. 00:00:37.000 --> 00:00:40.000 This one is specific to obviously for VMware. 00:00:40.000 --> 00:00:44.000 An example here is like they're saying that here's a vulnerability. 00:00:44.000 --> 00:00:51.000 An open SLP is used in EthicsEye has a use after free issue. 00:00:51.000 --> 00:01:03.000 So a use after free means that an application developer wrote a program that says, okay, dynamically as we're running, we're going to go and grab RAM, allocate RAM to the application when we need it. 00:01:03.000 --> 00:01:11.000 And when we're done, we're going to release that RAM and free that up and remove it from being allocated to the application. 00:01:11.000 --> 00:01:12.000 And they did the first part. 00:01:12.000 --> 00:01:16.000 They did go in and they did allocate the RAM to the application. 00:01:16.000 --> 00:01:19.000 They didn't release the RAM when they were done. 00:01:19.000 --> 00:01:24.000 The memory is still associated with that application. 00:01:24.000 --> 00:01:33.000 And there is ways of, you know, for bad actors to go in and take advantage of these memory spaces that are allocated to applications. 00:01:33.000 --> 00:01:36.000 And the application is not really using it anymore. 00:01:36.000 --> 00:01:41.000 And they can inject information into it and then try and get the application to execute it, right? 00:01:42.000 --> 00:01:52.000 So the solution to working around it to make this, you know, not a vulnerability for your EthicsEye host is to apply the newest patches for this. 00:01:52.000 --> 00:01:55.000 Keep your EthicsEye host up to date and patched. 00:01:55.000 --> 00:01:58.000 And this vulnerability has been patched. 00:01:58.000 --> 00:02:02.000 It has been resolved, okay? 00:02:02.000 --> 00:02:10.000 So there's another vulnerability out there where malicious actors can access virtual machines that are using 3D graphics enabled, right? 00:02:10.000 --> 00:02:18.000 And they're actually able to execute code on the hypervisor through the VM through this 3D graphic enablement. 00:02:18.000 --> 00:02:22.000 And a way that you can resolve that is to patch your host. 00:02:22.000 --> 00:02:24.000 That issue has already been patched. 00:02:24.000 --> 00:02:25.000 It's already been released. 00:02:25.000 --> 00:02:33.000 And it's no longer an issue if you have a currently updated and patched EthicsEye host. 00:02:33.000 --> 00:02:38.000 So what you might notice here is that, you know, which is a couple of examples. 00:02:38.000 --> 00:02:40.000 And the list is very, very long. 00:02:40.000 --> 00:02:49.000 There are a lot of vulnerabilities that have occurred to the EthicsEye hypervisor like any operating system and maybe fewer to EthicsEye than a lot of them. 00:02:49.000 --> 00:02:51.000 But they all have their fair share. 00:02:51.000 --> 00:02:52.000 Windows has their fair share. 00:02:52.000 --> 00:02:54.000 Even Mac has theirs. 00:02:54.000 --> 00:02:57.000 Linux gets, you know, vulnerabilities out there all the time. 00:02:57.000 --> 00:03:04.000 The issue is how quickly can we find patches for these, can we release, you know, and test patches for things like this. 00:03:04.000 --> 00:03:06.000 Keep your systems patched. 00:03:06.000 --> 00:03:13.000 The only thing that really you can't, you know, protect by patching against is what are called zero-day exploits, right? 00:03:13.000 --> 00:03:20.000 Zero-day means that this is out in the wild and it's not been discovered by the vendor yet necessarily, right? 00:03:20.000 --> 00:03:25.000 So when they first, first discover it before they patch for it, this is when we're done zero-day. 00:03:25.000 --> 00:03:28.000 But they will quickly release, hey, we have this problem. 00:03:28.000 --> 00:03:31.000 Here's a temporary fix to work around it possibly. 00:03:31.000 --> 00:03:32.000 Stop this service. 00:03:32.000 --> 00:03:36.000 Don't use this feature or something like that until they have a patch. 00:03:36.000 --> 00:03:38.000 Then they'll say, okay, and now we have this patch. 00:03:38.000 --> 00:03:39.000 Install the patch. 00:03:39.000 --> 00:03:43.000 And now you can enable this service or you can use this feature or, you know, something like that. 00:03:43.000 --> 00:03:50.000 VMware has a feature if you're using their NSX product that's called virtual patching. 00:03:50.000 --> 00:03:54.000 It's actually super cool in that if you know a program like SQL has a vulnerability, 00:03:54.000 --> 00:03:57.000 and Microsoft has released a patch for that vulnerability, 00:03:57.000 --> 00:04:00.000 or maybe they haven't got to a patch and VMware is aware of it, 00:04:00.000 --> 00:04:09.000 they can actually in the hypervisor level through their hypervisor firewall, that NSX, do what they call virtual patching. 00:04:09.000 --> 00:04:14.000 So when they see traffic going that looks like it's going to be attacking a vulnerability on an unknown application, 00:04:14.000 --> 00:04:15.000 they can block it. 00:04:15.000 --> 00:04:17.000 That's a pretty cool thing. 00:04:17.000 --> 00:04:22.000 Then when you have time to actually reboot the VM and, you know, shut it down and reboot it, that kind of thing, 00:04:23.000 --> 00:04:24.000 then you can do the real patching. 00:04:24.000 --> 00:04:27.000 That's pretty cool that they have that. 00:04:27.000 --> 00:04:31.000 But as far as the ESXi hosts go, keep them patched. 00:04:31.000 --> 00:04:34.000 When VMware releases updates, do your patching. 00:04:34.000 --> 00:04:35.000 Schedule your patching. 00:04:35.000 --> 00:04:37.000 Keep your systems patched. 00:04:37.000 --> 00:04:43.000 And most likely you'll be far, far less likely to get hit with a vulnerability. 00:04:43.000 --> 00:04:49.000 Most hackers out there honestly aren't very creative. 00:04:49.000 --> 00:04:51.000 They're using kits and this and that. 00:04:51.000 --> 00:04:54.000 There are some bad actors out there that are governments, you know, things like that. 00:04:54.000 --> 00:04:57.000 And they're really, you know, great at what they do. 00:04:57.000 --> 00:05:00.000 And they may even be inventing zero-day exploits. 00:05:00.000 --> 00:05:06.000 But the majority of them out there in the wild are actually just using, like, scripts and, you know, different things like that. 00:05:06.000 --> 00:05:12.000 And they're buying packages that have, you know, ability to exploit vulnerabilities, which means they've been out there for a while. 00:05:12.000 --> 00:05:14.000 And a lot of these vendors are already patched against that. 00:05:14.000 --> 00:05:18.000 And what they're doing is they're hoping that you haven't patched your systems. 00:05:19.000 --> 00:05:23.000 And if you haven't patched your systems, then they can exploit these vulnerabilities still. 00:05:23.000 --> 00:05:32.000 And because so many people don't patch, you know, frequently enough, often enough, and keep their systems current anywhere near enough, 00:05:32.000 --> 00:05:36.000 they actually still hit a lot of people who are vulnerable. 00:05:36.000 --> 00:05:41.000 But to avoid that, keep your systems patched, patched, you know, frequently patched. 00:05:41.000 --> 00:05:45.000 You know, when new patches come out, don't wait months and months to do it. 00:05:45.000 --> 00:05:47.000 Keep that kind of thing happening all the time. 00:05:47.000 --> 00:05:55.000 And your system will be much, much more hardened than systems that are, like, you know, three or four or five or six months out of date for patching. 00:05:55.000 --> 00:05:59.000 So keep your systems patched, and you'll keep your systems far more secure. 00:05:59.000 --> 00:06:00.000 All right. 00:06:00.000 --> 00:06:03.000 So we discussed some examples of some issues with VMware security. 00:06:03.000 --> 00:06:09.000 And the real takeaway here is keep your systems current and keep them patched.