Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
A zero-day vulnerability has been identified in VirtualBox that can be exploited to allow malware to escape from the virtual machine guest to the host machine. The security researcher Sergey Zelenyuk publicly released his findings on November 6th without notifying VirtualBox, meaning that no security patch is available at the time of publishing. Temporary mitigation measures were also released by Sergey (see What you should do about it).
At this time, successful exploitation requires advanced technical skills to develop and chain together with additional privilege escalation exploits. This vulnerability does not affect type-1 hypervisors, meaning cloud environments are not impacted. For these reasons, widespread adoption/exploitation is not expected in the near term.
Additional information
Virtual machines (VMs) are the emulation of an operating system, which allows users to have multiple separate operating systems on one physical device. Escaping the sandbox refers to malware that is opened on the virtual machine, circumventing security and affecting the underlying operating system. Virtual systems are made to be separate from the underlying system and are often used for malware analysis if escape is possible the threat actor gains access to more information story on the host machine and there is a higher chance of lateral movement to additional machines.
This zero-day vulnerability only affects type-two hypervisor of VirtualBox virtual machines. Type-two hypervisors are generally used for desktop machines, meaning that cloud environments are not affected. Sergey chose to release this vulnerability without notifying VirtualBox due to disagreements with the handling of vulnerability reporting and bug bounties; notably, the amount of time that passes before companies action the reported issue [1].
References:
[1] GitHub: MorteNoir1/virtualbox_e1000_0day VirtualBox E1000 Guest-to-Host Escape
https://github.com/MorteNoir1/virtualbox_e1000_0day