Memory Dedupe is Lethal

https://archive.is/aB7Kg

Flip Feng Shui: Hammering a Needle in the Software Stack

Summary: Memory deduplication feature for hypervisors is extremely dangrous. Can allow attackers to modify/sniff APT keys and source lists.

KVM users need not worry its not enabled by default and explicitly disabled in Whonix VM settings.

VBox users on Windows 8+ - you are completely hosed. Memory dedupe enabled by default. You need to move away from Windows for many good reasons too.

2 Likes