News for hackers. Stuff that matters.

A comment on One of my Drupal sites was hacked. Parent comment

Re:One of my Drupal sites was hacked by cortesoft on Wednesday April 30, 2014 @02:11PM (#7675145)
Really? Even if the web server was run in a VM?

If this is the case, then EC2 wouldn't work. Anyone with a VM could own the host (since they have root on their own VM?).

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by TallGuyShort on Wednesday April 30, 2014 @03:46PM (#7675868)
No, having root on the VM doesn't necessarily let you own the host (I don't think I implied that), but it's been known to happen: http://en.wikipedia.org/wiki/Virtual_machine_escape. If we're dealing with attacks as sophisticated as others mentioned in the thread, I wouldn't put that outside of the realm of possibility.

edit: at the very least I'd recreate the VM from scratch.

[ Parent | on HN ]