Slashdot Mirror

OS X Server running in VMware.

Coming this fall for everyone with less than a $50M data center.

http://virtualization.info/en/news/2011/04/more-details-about-vsphere-5-appear-online.html

While I've been a fan of VirtualBox for a while too, with the Oracle acquisition I wonder if adopting it now isn't just asking to take a ride onto another abandoned VM platform. Oracle already has Oracle VM, which is Xen based. At this point it looks like Oracle is going to turn VirtualBox into a gateway product used to hook people used to upsell onto Oracle VM. I'm not sure what that bodes for the future of VirtualBox development. I'm guessing that Oracle shifting development focus toward Oracle product compatibility concerns, so that it's easier to move paying customer to their more serious product, isn't a good sign for people who have been expecting VirtualBox to move further toward being more suitable for larger scale business deployments.

Phoenix is putting a hypervisor in ROM. The hypervisor is called HyperCore, and not much information is available on it yet. It does assume virtualization hardware, like Xen, rather than patching code like VMware.

This raises many big questions:

• Does Windows run under the hypervisor? (Side issues include Vista TPM validation and Microsoft license provisions against running consumer Vista on a virtual machine.)
• What's the hypervisor's interface? How do we program an app that runs on the hypervisor?
• What does this mean for drivers? Do drivers still talk to the real hardware, or just to the hypervisor?
• How does the hypervisor manage GPUs? (Minor issue for servers, but a really tough question on the desktop.)
• How does CPU scheduling work?

I found this useful:

Debunking Blue Pill myth

Even so, blue pill alters the fake clock value when it exits its own, slower, subroutines. You need an external time source. (As far as I know, this is the only weakness). So yes, it's not totally undetectable. Here's where I read about it.

"Blue Pill is the prototype resulting from a security study made by Joanna Rutkowska, which took advantage of new virtualization capabilities of AMD processors (known as SVM and previously as Pacifica) to inject a rootkit in a running Vista operating system"

When people have to resort to abuse to support their argument it makes me suspect that they are trying to distract from the facts. Adams don't actually debunk blue-pill, he calls the research quasi illiterate gibberish and accuses the researcher of attention-whoring, what ever that is. Nothing in the two cited articles provides any actual technical information as to why the injection technique wouldn't work.

"The non-exploit consists of a boot-loaded VT/SVM hypervisor that "http://x86vmm.blogspot.com/2006/08/blue-pill-is-q uasi-illiterate.html">undetectably" compromises your chain-loaded host. Recall with me the fundamental theorem of VT/SVM: "VT and SVM make nothing possible that was not possible before."

But one of the alleged benefits of VM was total isolation of the client OSs. If a VM machine can't protect a client OS from malicious processes then what is it for. Answer me that one and name calling don't count as a valid response.

key words: attention-whoring, quasi-illiterate gibberish, Re: "Blue Pill" is quasi-illiterate gibberish.

Blue Pill is bullshit. Don't believe me, believe the experts:

o Keith Adams, of VMware fame (binary translation and Intel VT work): http://x86vmm.blogspot.com/2006/08/blue-pill-is-qu asi-illiterate.html
o Anthony Liguori, of Xen fame (paravirtualization work): http://www.virtualization.info/2006/08/debunking-b lue-pill-myth.html

Isn't the "blue pill" just some almost far-fetched theory?
http://www.virtualization.info/2006/08/debunking-b lue-pill-myth.html

There's an interesting feasibility discusison of Blue Pill Here

First off, to date, no one has hijacked the Vista kernel. The only known way to do it so far is by bypassing the kernel altogether and run Vista in a VM. This works because it doesn't need any exploit in the OS (That's any OS from Vista to Linux, in fact this could be used to theoretically create a OS agnostic virus). This is what Blue Pill does, and Security experts have already stated that It's easy to detect

Second, if they did have a way to hack the kernel, that would be seen as a kernel exploit and would be patched. I doubt Microsoft would leave such an exploitable hole in their kernel setup for long.

It's already been demonstrated how easy it is to bypass the new "security"

You mean Blue Pill I believe. You know how they did it? by using VT (you know pacifica, the CPU partitioning capabilities in AMD processors) built into these newer processors to virtually circumvent the OS, not by hacking the kernel. In theory, this attack could be used successfully against ANY OS as long as it has access to sufficient permissions to activate VT and install. It's also easy to detect, as described Here

Jane Walker == TechTarget

Seriously, just two minutes on Google led to MUCH better articles, e.g. CMPNet, eWeek, and Virtualization.info

OK guys, now I'm confused. WTF is going on here? Have the Xen people been bought my Microsoft?

No, TFA is just misleading. A while back, Microsoft documented the VHD format under an anti-GPL license (similar to what they did with CIFS a while ago). XenSource, the commercial company trying to make money from Xen, simply downloaded this license after agreeing to the terms and announced that their product, XenEnterprise, will support importing VHD hard disks.

There is no Microsoft/Open Source cooperation here. See http://www.virtualization.info/2005/10/microsoft-d iscloses-virtual-hard-disk.html.