Stealing virtual machines and virtual machine data

Network administration - If you use an virtualized email server or payroll system in any environment, any user with administrative access to the virtual environment can easily steal this system and all data. stored in it without leaving any trace. Stealing a physical server from the data center without being detected is impossible, however, stealing a virtual machine can be done anywhere on the network, and everyone You can easily use a USB drive to steal the virtual machines you want.

Stealing virtual machines and virtual machine data Picture 1 Figure 1. We can affirm that virtualization has a lot of benefits compared to physical servers, but there are also many unanticipated risks that we need to take into account in order to apply good protection Most avoid loss of important data. Since the virtual machine is encapsulated in a single virtual disk file on a virtual server, it is not difficult to create a copy of the virtual disk file and access all the data in it with appropriate access. well suited. This is a very simple operation, and in this article we will learn the steps to take to protect the environment against similar attacks.

There are basically two ways to access the virtual disk file (.vmdk) of a virtual machine. The first way is to use the ESX Service Console. If someone knows the root password or a user account on the server, they can gain access to VMFS drives containing virtual machine files and then use copy tools such as Secure Copy or SCP. to copy these files again. The second way is to use the vSphere / VMware Infrastructure Client with a built-in data warehouse browsing tool; This is the method we will study.

Step 1: Snapshot virtual machine

The first thing to do is take a virtual machine image. Then the virtual machine's virtual drive will go into read-only mode and create a new file to write new data to the drive. We have to do this because this virtual machine is running and using its disk file. If you skip this operation, we will not be able to copy the VMDK file because it is locked. This is the same method that many virtual machine backup applications use when backing up virtual machines. If the virtual machine is off or hung, then we can skip this operation.



Step 2: Copy the virtual drive

The next step is to create a copy of the virtual disk file. We can choose to copy the configuration file (.vmx) to this virtual machine so it can be imported into Player or Workstation more easily. The virtual disk file (.vmdk) actually consists of two files, a large file containing disk blocks, a small file is a text file describing the drive. If we use the integrated repository search application in the vSphere workstation, these files will appear as a single and copied file. If you use another copy application like WinSCP, you will have to copy both files.

To browse the database when the virtual machine is running, go to the home directory of the virtual machine, select the required files and then click Download . We can then select a folder on the PC running the vSphere workstation to download the selected files. Depending on the size of the virtual disk file and network speed, these files will be downloaded over a certain period of time. When finished, we will move on to the final step. We can delete the snapshot of the virtual machine when we have finished copying the virtual disk file.

---

Step 3: Access the virtual disk file

1. Method 1: Install the virtual drive

---

---