The Root Backdoor Every QEMU VM Ships by Default
Most of the virtual machines running in the world at this moment booted with a root-level backdoor already wired in. I will defend the word. Nobody can count live VMs exactly, but the order of magnitude is not in question: tens of millions on QEMU and KVM alone, and that is the conservative read, because KVM sits under most of the public cloud. On a large share of them, an account on the host can run commands as root inside the running guest. No guest password. No SSH session. No packet on the guest network. It is not planted by an attacker and it is not a bug. It is the guest agent the platform ships, running as root on the far end of a channel the host controls, with the one setting that turns it into a remote root shell left on at install and never questioned since. Documented, default, working as intended. The distance between what that feature is documented to do and what anyone actually defends against is the ground we build on. ...