Hyper-V bug that could crash 'big portions of Azure cloud infrastructure': Code published

Security researchers have posted proof of concept code that exploits a recently patched vulnerability in Microsoft's Hyper-V hypervisor. The bug enables code in the guest to crash the host, and in some circumstances compromise the host's security. A fundamental principle of virtualization is that the virtual machine guests are …

[Anonymous Coward]

The company I work for is moving everything to Azure because it's way more reliable, secure and cheaper to do this than to run some machines in house.

Am I allowed to distribute links to this article?

[heyrick]

Distribute links? How about print it out, laminate it, then super glue it to the wall of the staff break room.

Anonymously, of course.

[Anonymous Coward]

Because all the on-premises software is entirely bug free? Quite an impressive achievement if so.

[Potemkine!]

Nice strawman fallacy

[Anonymous Coward]

All on-premises software / systems aren't publicly available to use by anyone to do with what they like. Defense in depth is possible. Or do you / would you allow random people to create VMs, containers, run processes on your internal private systems?

[Martin M]

On the flip side, where do you think this vulnerability is likely to have been patched first - on-prem Hyper V or Azure?

[Anonymous Coward]

Where would it likely be exploited first on prem, private system, or a publicly available system?

[Throatwarbler Mangrove]

Make $$$ BY m1ning crypt0!

I MAKE $$$ BY MINING CRYPTO USING CLOUD RESOURCES! Ethereum, Litecoin, Bitcoin, Dogecoin, etc..... I used to do IT for boring enterprise shops, now I just SIT AROUND ALL DAY and let other people's computers DO THE WORK FOR ME! EMAIL ME at [e-mail] with your Azure organization name, and I'll DO THE REST!

[katrinab]

When you are on-premises, you can deploy other measures to protect access to your vms. On The Cloud, you can only protect your own vms, not those of other customers on the same physical host.

[Mad Mike]

Risk factors

Whilst it's true that Microsoft or any other public cloud provider spends a fortune on security, there is also the factor that Azure (or whatever cloud) also has a much bigger target on it than the average on-prem datacentre. Plus, it is publicly accessible by anyone who wants to set up an account, which greatly increases attack surface in it's own right. Is the extra money spent on security enough to counteract the greater risks public cloud is exposed to? That's a matter of opinion. Whilst on-prem might be vulnerable as well, many companies are relatively anonymous on-prem and aren't obvious targets for attackers. Plus, they can put extra layers of security round themselves to control who can connect etc. Finally, an attack against an on-prem datacentre ensures only one company is hit, whereas an attack on Azure ensures the impact is so much wider. Question is, how long till someone exploits an issue in Azure or any other public cloud? It seems an inevitability it will occur.

[YetAnotherJoeBlow]

"Vulnerabilities that breach this barrier are particularly serious for hosting companies..."

Thats why the hack got over 30 grand...