There have always been concerns about the security of cloud computing environments, but recent news regarding the so-called VENOM flaw may send some organizations into full-blown panic mode.
An acronym for “virtualized environment neglected operations manipulation,” the VENOM flaw was first discovered by researchers at a firm called CrowdStrike based in Irvine, California. The issue stems from a problem in the code for virtual floppy disk controllers in an open-source technology called QUEMU, which serves as a sort of window or hypervisor in virtual machine environments. While floppy drives are ancient history to many IT administrators, hackers could still use the exploit to penetrate systems that use common tools to virtualize their IT infrastructure, provided they have root or admin permissions.
ZDNet reported that major open source organizations have been quick to offer patches, including Red Hat Software, Xen and those behind the QUEMU project itself. In some cases, making the necessary changes will involve executing a series of commands and even powering-off virtual machine guests, which could have an operational impact in some organizations. Of course, that’s still preferable to a cybercriminal taking advantage of the VENOM flaw, which could threaten an enormous number of data centers.
The nature of the VENOM flaw quickly drew comparisons with last year’s Heartbleed, but in some respects it may be even worse. That’s because, as Fortune explained, there has long been a sense that virtualization technology allowed companies to isolate virtual machines in a way that would make them safer. If hackers know what they’re doing, they could use a bug like this to overwrite parts of a machine’s memory, execute code and do other damage.
Given that virtual machines allow companies to host compute resources on behalf of other firms, the VENOM flaw could also tarnish the reputations of major cloud computing firms. VentureBeat noted that Amazon, Rackspace and Google were all quick to reassure customers and prospects that their data centers are not at risk or that they had already addressed the vulnerability. Still, there may be questions about how they stay on top of potential bugs like this and how quickly they can plug any holes.
On the other hand, it’s important to stress that there have been no reports of the VENOM flaw leading to any actual data theft, and CSO Online suggested the hype and “marketing” around the potential danger has already gotten out of hand. For most organizations, however, it only takes being bitten once by a major security problem to become twice shy.