vmware

A long, costly road ahead for customers abandoning Broadcom’s VMware

Biz & IT, Broadcom, vmware / Kris Guyer / January 27, 2025

“We loved VMware, and then when Broadcom bought ‘em, we hated ‘em.”

Broadcom’s ownership of VMware has discouraged many of its customers, as companies are displeased with how the trillion-dollar firm has run the virtualization business since buying it in November 2023. Many have discussed reducing or eliminating ties with the company.

Now, over a year after the acquisition, the pressure is on for customers to start committing to a VMware subscription, forego VMware support, or move on from VMware technologies. The decision is complex, with long-term implications no matter which way a customer goes.

Ars Technica spoke with an IT vendor manager who has been using VMware’s vSphere since the early 2000s. The employee, who works for a global food manufacturing firm with about 5,500 employees, asked to keep their name and company anonymous due to privacy concerns for the business.

“We love it. … It’s hard for us to figure out how we can live without it, but we’re going to,” the IT manager said.

The food manufacturer has about 300 VMware virtual machines (VMs), and every company application runs on top of VMware. Its five-year enterprise agreement with VMware expired in December, making the manufacturer ineligible for VMware support unless it buys a VMware subscription. The company started exploring virtualization alternatives this summer because costs associated with running vSphere are set to rise fourfold, according to the IT manager. As with other VMware customers, the price increases are largely due to Broadcom bundling unwanted VMware products together.

“They wouldn’t sell us what we need,” the IT manager said.

While it looks for a new platform, the manufacturer is relying on support from Spinnaker, which started offering software maintenance support for VMware following Broadcom’s acquisition. In an example of how widespread VMware support concerns are, Spinnaker’s VMware support business has had more leads than any of Spinnaker’s other support businesses, including for Oracle or SAP, said Martin Biggs, Spinnaker’s VP and managing director of strategic initiatives and EMEA.

Organizations contacting Spinnaker are reporting price increases of “3–6x” on average, Biggs told Ars. The largest price rise Spinnaker has heard about is a reported twentyfold increase in costs, he said.

Biggs said that Broadcom has started to discount some subscriptions, with price increases going from seven- or eightfold to three- or fourfold, or “sometimes a little bit less.” This could pressure customers to commit to VMware while terms are more favorable than they might be in the future. Speaking to The Register this month, Gartner VP analyst Michael Warrilow said he feared Broadcom would raise VMware prices higher in the future.

Heightening the potential consequences associated with staying with or leaving VMware, Warrilow emphasized that Broadcom prefers two- or three-year subscriptions, meaning customers may find themselves facing a more pricey VMware sooner than later.

“Everybody’s asking what everybody else is doing, and everybody else is asking what everybody else is doing, so nobody’s really doing anything,” he said.

The Register also recently reported that customers are being pressured into three-year long VMware subscriptions, citing an unnamed VMware customer that it spoke with and a discussion on Reddit. When reached for comment, Broadcom only referred The Register to a June blog post by Broadcom CEO Hock Tan about evolving VMware strategy.

Losing support

Support is a critical factor for numerous customers considering migrating from VMware, especially because VMware perpetual licenses are no longer being sold or supported by Broadcom. But there’s also concern about support offered to clients with subscriptions.

For the food manufacturer currently researching VMware rivals, a perceived lack of support under Broadcom was also a deterrent. The company’s IT manager said that after Broadcom bought VMware, the manufacturer was no longer able to contact VMware directly for support and was told in July that it should direct problems to IT distributor Ingram Micro moving forward.

The manager said this information was relayed to the customer after a support ticket it filed was automatically moved to Ingram, with Broadcom telling the firm it wasn’t big enough to receive direct support. Ingram’s response times were a week or longer, and in December, Ingram announced a severe reduction of its VMware business (VMware still works with other distributors, like Arrow).

Support concerns from VMware resellers started before Ingram’s announcement, though. An anonymous reseller, for example, told CRN that it had to wait a month on average for VMware quotes through a distributor, compared to “two to three days” pre-Broadcom. The Register, citing VMware customers, also reported that Ingram was having difficulties handling “the increased responsibilities it assumed,” citing VMware customers.

Migration is burdensome

In a January Gartner research note entitled “Estimating a Large-Scale VMware,” Gartner analysts detailed the burdens expected for large-sized companies moving off of VMware. The note defined a large-scale migration as a “concerted program of work covering the migration of a significant portion of virtualized workloads” that “would likely represent 2,000 or more” VMs, “and/or at least 100 hosts.” That’s a much larger migration than the food manufacturer’s 300 VMs, but Gartner’s analysis helps illustrate the magnitude of work associated with migrating.

Gartner’s note estimated that large-scale migrations, including scoping and technical evaluation, would take 18 to 48 months. The analysts noted that they “expect a midsize enterprise would take at least two years to untangle much of its dependency upon VMware’s server virtualization platform.”

The analysts also estimated migration to cost $300 to $3,000 per VM if the user employed a third-party service provider. Critically, the report adds:

It is highly likely that other costs would be incurred in a large-scale migration. This includes acquisition of new software licenses and/or cloud expenses, hardware purchases (compute, storage), early termination costs related to the existing virtual environment, application testing/quality assurance, and test equipment.

The heavy costs—in terms of finances, time, and staff—force customers to face questions and hesitations around leaving VMware, despite many customers facing disruption from Broadcom-issued changes to the platform.

When asked if there’s anything Broadcom could do to win back the food manufacturer’s 300 VMs, its IT manager told Ars that if Broadcom offered a subscription to vSphere alone, the manufacturer would reconsider, even if subscription costs were twice as expensive as before.

For the global food manufacturer, the biggest challenge in ditching VMware is internal, not technical. “We just don’t have enough internal resources and timing,” the manager said. “That’s what I’m worried about. This is going to take a lot of time internally to go through this whole process, and we’re shorthanded as it is. It’s such a big, heavy lift for us, and we’re also very risk averse, so swapping out that piece of technology in our infrastructure is risky.”

Stuck between a rock and a hard place

VMware users are now at a crossroads as they’re forced to make crucial decisions for their IT infrastructure. Ditching or sticking with VMware both have long-lasting implications; migrations are onerous and pricey, but life under Broadcom will be expensive, with potential future bumps and twists.

Broadcom has previously responded to Ars’ and others’ requests for comment around customer complaints with blog posts from Broadcom’s Tan that emphasize commitment to VMware’s strategic changes. But some will brave costly challenges to avoid those moves. Summarizing their take on Broadcom’s changes, the food manufacturer’s IT executive said, “We loved VMware. And then when Broadcom bought ’em, we hated ’em.”

Scharon is a Senior Technology Reporter at Ars Technica writing news, reviews, and analysis on consumer gadgets and services. She’s been reporting on technology for over 10 years, with bylines at Tom’s Hardware, Channelnomics, and CRN UK.

A long, costly road ahead for customers abandoning Broadcom’s VMware Read More »

As firms abandon VMware, Broadcom is laughing all the way to the bank

Biz & IT, Broadcom, vmware / Mike M. / December 19, 2024

2025 challenges

Broadcom seemed okay with ending business with Ingram, which ties it to solution providers that may be supporting smaller firms. At the same time, Broadcom has shown willingness to fight for the business of large accounts.

For example, this month it settled an increasingly nasty dispute in which AT&T sued Broadcom for allegedly breaking a contract to provide perpetual license support. Broadcom infamously stopped VMware perpetual license sales, in favor of subscriptions, in December 2023.

Broadcom is also paying close attention to VMware’s biggest accounts, taking over 500 of those biggest accounts directly, thereby barring channel partners from deals.

Broadcom originally planned to take VMware’s biggest 2,000 accounts direct. But as Canalys chief analyst Alastair Edwards put it, letting 1,500 of the biggest accounts be run by channel partners helps tie professional services to VMware products, making migrations harder.

However, the VMware channel is under turmoil, having undergone numerous business-impacting changes over the past year, including Broadcom killing the VMware partner program in favor of its own, while announcing that there will be a new VMware channel chief, as CRN reported. Some of the resellers that could help VMware keep customers are showing frustration with the changes and what the characterize as poor communication from Broadcom.

“Broadcom has abandoned the channel market by making it nearly impossible to work with them due to constantly changing requirements, packaging and changes to the program,” Jason Slagle, president of Toledo-based managed services provider and VMware partner CNWR, told CRN today.

Meanwhile, Forrester analysts Michele Pelino and Naveen Chhabra predict that next year, “VMware’s largest 2,000 customers will shrink their deployment size by an average of 40 percent,” in favor of “public cloud, on-premises alternatives, and new architecture.”

Still, “Broadcom’s price increases and cost-cutting measures are expected to boost its net profits, as there are not many credible competitors capable of helping clients replace VMware virtualization,” the Forrester analysts said.

So although Broadcom is challenged to maintain business from VMware’s biggest accounts and appease the solution providers driving smaller accounts, it’s expected to keep making money off of VMware—even as firms like Ingram close the door on it.

As firms abandon VMware, Broadcom is laughing all the way to the bank Read More »

Broadcom reverses controversial plan in effort to cull VMware migrations

Biz & IT, Broadcom, vmware / Rejus Almole / December 5, 2024

Customers re-examining VMware dependence

VMware has been the go-to virtualization platform for years, but Broadcom’s acquisition has pushed customers to reconsider their VMware dependence. A year into its VMware buy, Broadcom is at a critical point. By now, customers have had months to determine whether they’ll navigate VMware’s new landscape or opt for alternatives. Beyond dissatisfaction with the new pricing and processes under Broadcom, the acquisition has also served as a wake-up call about vendor lock-in. Small- and medium-size businesses (SMBs) are having the biggest problems navigating the changes, per conversations that Ars has had with VMware customers and analysts.

Speaking to The Register, Edwards claimed that migration from VMware is still modest. However, the coming months are set to be decision time for some clients. In a June and July survey that Veeam, which provides hypervisor backup solutions, sponsored, 56 percent of organizations were expecting to “decrease” VMware usage by July 2025. The survey examined 561 “senior decisionmakers employed in IT operations and IT security roles” in companies with over 1,000 employees in the US, France, Germany, and the UK.

Impact on migrations questioned

With the pain points seemingly affecting SMBs more than bigger clients, Broadcom’s latest move may do little to deter the majority of customers from considering ditching VMware.

Speaking with Ars, Rick Vanover, VP of product strategy at Veeam, said he thinks Broadcom taking fewer large VMware customers direct will have an “insignificant” impact on migrations, explaining:

Generally speaking, the largest enterprises (those who would qualify for direct servicing by Broadcom) are not considering migrating off VMware.

However, channel partners can play a “huge part” in helping customers decide to stay or migrate platforms, the executive added.

“Product telemetry at Veeam shows a slight distribution of hypervisors in the market, across all segments, but not enough to tell the market that the sky is falling,” Vanover said.

In his blog, Edwards argued that Tan is demonstrating a “clear objective to strip out layers of cost and complexity in the business, and return it to strong growth and profitability.” He added: “But so far this has come at the expense of customer and partner relationships. Has VMware done enough to turn the tide?”

Perhaps more pertinent to SMBs, Broadcom last month announced a more SMB-friendly VMware subscription tier. Ultimate pricing will be a big factor in whether this tier successfully maintains SMB business. But Broadcom’s VMware still seems more focused on larger customers.

Broadcom reverses controversial plan in effort to cull VMware migrations Read More »

Company claims 1,000 percent price hike drove it from VMware to open source rival

Biz & IT, Broadcom, Open Source, vmware / Kris Guyer / December 2, 2024

Companies have been discussing migrating off of VMware since Broadcom’s takeover a year ago led to higher costs and other controversial changes. Now we have an inside look at one of the larger customers that recently made the move.

According to a report from The Register today, Beeks Group, a cloud operator headquartered in the United Kingdom, has moved most of its 20,000-plus virtual machines (VMs) off VMware and to OpenNebula, an open source cloud and edge computing platform. Beeks Group sells virtual private servers and bare metal servers to financial service providers. It still has some VMware VMs, but “the majority” of its machines are currently on OpenNebula, The Register reported.

Beeks’ head of production management, Matthew Cretney, said that one of the reasons for Beeks’ migration was a VMware bill for “10 times the sum it previously paid for software licenses,” per The Register.

According to Beeks, OpenNebula has enabled the company to dedicate more of its 3,000 bare metal server fleet to client loads instead of to VM management, as it had to with VMware. With OpenNebula purportedly requiring less management overhead, Beeks is reporting a 200 percent increase in VM efficiency since it now has more VMs on each server.

Beeks also pointed to customers viewing VMware as non-essential and a decline in VMware support services and innovation as drivers for it migrating from VMware.

Broadcom didn’t respond to Ars Technica’s request for comment.

Broadcom loses VMware customers

Broadcom will likely continue seeing some of VMware’s older customers decrease or abandon reliance on VMware offerings. But Broadcom has emphasized the financial success it has seen (PDF) from its VMware acquisition, suggesting that it will continue with its strategy even at the risk of losing some business.

Company claims 1,000 percent price hike drove it from VMware to open source rival Read More »

New SMB-friendly subscription tier may be too late to stop VMware migrations

Biz & IT, Broadcom, vmware / Kris Guyer / November 8, 2024

Broadcom has a new subscription tier for VMware virtualization software that may appease some disgruntled VMware customers, especially small to medium-sized businesses. The new VMware vSphere Enterprise Plus subscription tier creates a more digestible bundle that’s more appropriate for smaller customers. But it may be too late to convince some SMBs not to abandon VMware.

Soon after Broadcom bought VMware, it stopped the sale of VMware perpetual licenses and started requiring subscriptions. Broadcom also bundled VMware’s products into a smaller number of SKUs, resulting in higher costs and frustration for customers that felt like they were being forced to pay for products that they didn’t want. All that, combined with Broadcom ditching some smaller VMware channel partners (and reportedly taking the biggest clients direct), have raised doubts that Broadcom’s VMware would be a good fit for smaller customers.

“The challenge with much of the VMware by Broadcom changes to date and before the announcement [of the vSphere Enterprise Plus subscription tier] is that it also forced many organizations to a much higher offering and much more components to a stack that they were previously uninterested in deploying,” Rick Vanover, Veeam’s product strategy VP, told Ars.

On October 31, Broadcom announced the vSphere Enterprise Plus subscription tier. From smallest to largest, the available tiers are vSphere Standard, vSphere Enterprise Plus, vSphere Foundation, and the flagship VMware Cloud Foundation. The introduction of vSphere Enterprise Plus means that customers who only want vSphere virtualization can now pick from two bundles instead of one.

“[T]o round out the portfolio, for customers who are focused on compute virtualization, we will now have two options, VMware vSphere Enterprise Plus and VMware vSphere Standard,” Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundation division of Broadcom, explained in a blog post.

New SMB-friendly subscription tier may be too late to stop VMware migrations Read More »

“Extreme” Broadcom-proposed price hike would up VMware costs 1,050%, AT&T says

AT&T, Biz & IT, Broadcom, vmware / Paul Patrick / October 1, 2024

Legal dispute continues —

Broadcom “preventing some vendors from selling products to us,” AT&T alleges.

Scharon Harding – Oct 1, 2024 6: 22 pm UTC

Broadcom quoted AT&T a 1,050 percent price hike for VMware offerings, AT&T has claimed in legal documents.

AT&T sued Broadcom on August 29, accusing Broadcom of unlawfully denying it the second of three one-year renewals for support services that AT&T thinks it’s entitled to. AT&T cites a contract signed before Broadcom bought VMware. The telecommunications firm says it has 75,000 virtual machines (VMs) across approximately 8,600 servers running on VMware. Broadcom, which has stopped selling VMware perpetual licenses, has said that AT&T missed its opportunity to renew support and that the contract between VMware and AT&T has an “End of Availability” provision allowing VMware to retire products and services.

Legal filings from September 27 and spotted by The Register today show an email [PDF] that AT&T EVP and GM of wireline transformation and global supply chain Susan A. Johnson apparently sent to Broadcom CEO Hock Tan pointing to “an impasse” over VMware.

Johnson argued in the email that AT&T should have the right to renew support through September 2026 thanks to a previously signed five-year deal:

This proposed annual increase of +1,050% in one year is extreme and certainly not how we expect strategic partners to engage in doing business with AT&T.

A 1,050 percent price hike is the largest that Ars Technica has heard of being proposed by Broadcom. At this time, it’s unknown if AT&T’s claims are accurate. Broadcom hasn’t publicly commented on the allegations.

Many VMware customers have pointed to VMware becoming more expensive under Broadcom, though. Broadcom’s changes to selling VMware have reportedly included bundling products into only about two SKUs and higher CPU core requirements. In March, customers reportedly complained about price increases of up to 600 percent, per The Register. And in February, ServeTheHome said small cloud service providers reported prices increasing tenfold.

AT&T’s contract with VMware may be one of the firm’s bigger accounts. A 1,050 percent price hike would be another level, however, even for a company the size of AT&T. Per Johnson’s email, AT&T and Broadcom have had a “strategic relationship” for over a decade.

The email reads:

… AT&T has decided to pursue a legal strategy along with a disciplined plan to invest to migrate away, all of which will quickly become public. I truly wish we had another option. Unfortunately, this decision will impact the future of our overall relationship and how we manage spend in other Broadcom areas.

AT&T on potentially migrating off VMware

In her email, Johnson points to migration costs as impacting how much AT&T is willing to pay for VMware.

According to the message, projected costs for moving AT&T off of VMware are $40 million to $50 million. AT&T is said to use VMware-based VMs for customer services operations and for operations management efficiency. Per AT&T’s email, migration “has a very quick payback” and “strong” internal rate of return, “especially given the high licensing costs proposed.”

On September 20, Broadcom requested that AT&T’s request to block Broadcom from discontinuing VMware support be denied. In legal documents [PDF], Broadcom said that AT&T is planning to ditch VMware and that AT&T could have spent “the last several months or even years” making the transition.

In an affidavit filed on September 27 [PDF], Johnson stated that her email to Tan does not suggest that migration “would be easy, quick, or inexpensive” and that “none of those would be accurate statements.”

“My point was that although it is not easy, cheap, or quick to migrate off VMware, Defendants’ high fees will incentivize us to migrate to another solution,” the affidavit reads.

Johnson also claimed that AT&T started exploring options for getting off VMware in December but thought that it had time to make decisions, since it believed it could opt to renew support for its licenses until September 2026.

In another legal filing from September 27 [PDF], Gordon Mansfield, president of global technology planning at AT&T Services, says:

AT&T currently estimates it will take a period of years to transition all of its servers currently operating with the VMware software away from VMware. Moreover, Defendants have not made it easy to do so since we understand that they are preventing some vendors from selling certain products to us.

The filing didn’t get into further detail about how exactly Broadcom could be blocking product sales to AT&T. Broadcom hasn’t publicly responded to Mansfield’s claim.

Regarding AT&T’s lawsuit, Broadcom has previously told Ars Technica that it “strongly disagrees with the allegations and is confident we will prevail in the legal process.”

Since Broadcom’s VMware acquisition, most customers are expected to have at least considered ditching VMware. However, moving can be challenging and costly as some IT environments are heavily dependent on VMware. Being able to ensure that things are able to run as expected during the transition period has also complicated potential migrations.

While AT&T and Broadcom’s legal dispute continues, Broadcom has agreed to continue providing AT&T with VMware support until October 9. A preliminary injunction hearing is scheduled for October 15.

“Extreme” Broadcom-proposed price hike would up VMware costs 1,050%, AT&T says Read More »

Broadcom responds to AT&T’s VMware support lawsuit: AT&T has “other options”

AT&T, Biz & IT, Broadcom, vmware / Kris Guyer / September 24, 2024

Legal battle —

Broadcom defends against renewal, citing “End of Availability” provision.

Scharon Harding – Sep 24, 2024 4: 34 pm UTC

Broadcom is accusing AT&T of trying to “rewind the clock and force” Broadcom “to sell support services for perpetual software licenses… that VMware has discontinued from its product line and to which AT&T has no contractual right to purchase.” The statement comes from legal documents Broadcom filed in response to AT&T’s lawsuit against Broadcom for refusing to renew support for its VMware perpetual licenses [PDF].

On August 29, AT&T filed a lawsuit [PDF] against Broadcom, alleging that Broadcom is breaking a contract by refusing to provide a one-year renewal for support for perpetually licensed VMware software. Broadcom famously ended perpetual VMware license sales shortly after closing its acquisition in favor of a subscription model featuring about two bundles of products rather than many SKUs.

AT&T claims its VMware contract (forged before Broadcom’s acquisition closed in November) entitles it to three one-year renewals of perpetual license support, and it’s currently trying to enact the second one. AT&T says it uses VMware products to run 75,000 virtual machines (VMs) across about 8,600 servers. The VMs are for supporting customer services operations and operations management efficiency, per AT&T. AT&T is asking the Supreme Court of the State of New York to stop Broadcom from ending VMware support services for AT&T and for “further relief” as deemed necessary.

On September 20, Broadcom filed for AT&T’s motion to be denied. Its defense includes its previously taken stance that VMware was moving toward a subscription model before Broadcom bought it. The transition from perpetual licenses to subscriptions was years in the making and, thus, something for which AT&T should have prepared, according to Broadcom. Broadcom claims that AT&T has admitted that it intends to migrate away from VMware software and that AT&T could have spent “the last several months or even years” doing so.

The filing argues: “AT&T resorts to sensationalism by accusing Broadcom of using ‘bullying tactics’ and ‘price gouging.’ Such attacks are intended to generate press and distract the Court from a much simpler story.”

Broadcom claims the simple story is that:

… the agreement contains an unambiguous “End of Availability” provision, which gives VMware the right to retire products and services at any time upon notice. What’s more, a year ago, AT&T opted not to purchase the very Support Services it now asks the Court to force VMware to provide. AT&T did so despite knowing Defendants were implementing a long planned and well-known business model transition and would soon no longer be selling the Support Services in question.

Broadcom says it has been negotiating with AT&T “for months” about a new contract, but the plaintiff “rejected every proposal despite favorable pricing.”

Broadcom’s filing also questions AT&T’s request for mandatory injunction, claiming that New York only grants those in “rare circumstances,” which allegedly don’t apply here.

AT&T has options, Broadcom says

AT&T’s lawsuit claims losing VMware support will cause extreme harm to itself and beyond. The lawsuit says that 22,000 of AT&T’s VMware VMs are used for support “of services to millions of police officers, firefighters, paramedics, emergency workers, and incident response team members nationwide… for use in connection with matters of public safety and/or national security.” It also claimed that communications for the Office of the President are at risk without VMware’s continued support.

However, Broadcom claims that AT&T has other choices, saying:

AT&T does have other options and, therefore, the most it can obtain is monetary damages. The fact that AT&T has been given more than eight-months’ notice and has in the meantime failed to take any measures to prevent its purported harm (e.g., buy a subscription for the new offerings or move to another solution) is telling and precludes any finding of irreparable harm. Even if AT&T thinks it deserves better pricing, it could have avoided its purported irreparable harm by entering in a subscription based deal and suing for monetary damages instead of injunctive relief.

AT&T previously declined to answer Ars Technica’s questions about its backup plans for supporting such important customers should it lose VMware support.

Broadcom has rubbed some customers the wrong way

Broadcom closed its VMware acquisition in November and quickly made dramatic changes. In addition to Broadcom’s reputation for overhauling companies after buying them, moves like ending perpetual licenses, taking VMware’s biggest customers directly instead of using channel partners, and raising costs by bundling products and issuing higher CPU core requirements have led customers and partners to reconsider working with the company. Migrating from VMware can be extremely challenging and expensive due to its deep integration into some IT environments, but many are investigating migration, and some expect Broadcom to face years of backlash.

As NAND Research founder and analyst Steve McDowell told TechTarget about this case:

It’s very unusual for customers to sue their vendors. I think Broadcom grossly underestimated how passionate the customer base is, [but] it’s a captive audience.

As this lawsuit demonstrates, Broadcom’s VMware has brought serious customer concerns around ongoing support. Companies like Spinnaker Support are trying to capitalize by offering third-party support services.

Martin Biggs, VP and managing director of EMEA and strategic initiatives at Spinnaker, told Ars Technica that his company provides support so customers can spend time determining their next move, whether that’s buying into a VMware subscription or moving on:

VMware customers are looking for options; the vast majority that we have spoken to don’t have a clear view yet of where they want to go, but in all cases the option of staying with VMware for the significantly increased fees is simply untenable. The challenge many have is that not paying fees means not getting support or security on their existing investment.

VMware’s support for AT&T was supposed to end on September 8, but the two companies entered an agreement to continue support until October 9. A hearing on a preliminary injunction is scheduled for October 15.

Broadcom responds to AT&T’s VMware support lawsuit: AT&T has “other options” Read More »

AT&T sues Broadcom for refusing to renew perpetual license support

AT&T, Biz & IT, Broadcom, vmware / Rejus Almole / September 5, 2024

AT&T vs. Broadcom —

Ars cited in lawsuit AT&T recently filed against Broadcom.

Scharon Harding – Sep 5, 2024 7: 28 pm UTC

Signage is displayed outside the Broadcom offices on June 7, 2018 in San Jose, California.

AT&T filed a lawsuit against Broadcom on August 29 accusing it of seeking to “retroactively change existing VMware contracts to match its new corporate strategy.” The lawsuit, spotted by Channel Futures, concerns claims that Broadcom is not letting AT&T renew support services for previously purchased perpetual VMware software licenses unless AT&T meets certain conditions.

Broadcom closed its $61 billion VMware acquisition in November and swiftly enacted sweeping changes. For example, in December, Broadcom announced the end of VMware perpetual license sales in favor of subscriptions of bundled products. Combined with higher core requirements per CPU subscription, complaints ensued that VMware was getting more expensive to work with.

AT&T uses VMware software to run 75,000 virtual machines (VMs) across about 8,600 servers, per the complaint filed at the Supreme Court of the State of New York [PDF]. It reportedly uses the VMs to support customer service operations and for operations management efficiency.

AT&T feels it should be granted a one-year renewal for VMware support services, which it claimed would be the second of three one-year renewals to which its contract entitles it. According to AT&T, support services are critical in case of software errors and for upkeep, like security patches, software upgrades, and daily maintenance. Without support, “an error or software glitch” could result in disruptive failure, AT&T said.

AT&T claims Broadcom refuses to renew support and plans to terminate AT&T’s VMware support services on September 9. It asked the court to stop Broadcom from cutting VMware support services and for “further relief” deemed necessary. The New York Supreme Court has told Broadcom to respond within 20 days of the complaint’s filing.

In a statement to Ars Technica, an AT&T spokesperson said: “We have filed this complaint to preserve continuity in the services we provide and protect the interests of our customers.”

AT&T accuses Broadcom of trying to make it spend millions on unwanted software

AT&T’s lawsuit claims that Broadcom has refused to renew support services for AT&T’s perpetual licenses unless AT&T agrees to what it deems are unfair conditions that would cost it “tens of millions more than the price of the support services alone.”

The lawsuit reads:

Specifically, Broadcom is threatening to withhold essential support services for previously purchased VMware perpetually licensed software unless AT&T capitulates to Broadcom’s demands that AT&T purchase hundreds of millions of dollars’ worth of bundled subscription software and services, which AT&T does not want.

After buying VMware, Broadcom consolidated VMware’s offering from about 8,000 SKUs to four bundles, per Channel Futures. AT&T claims these subscription offerings “would impose significant additional contractual and technological obligations.” AT&T claims it might have to invest millions to “develop its network to accommodate the new software.”

VMware and AT&T’s agreement precludes “Broadcom’s attempt to bully AT&T into paying a king’s ransom for subscriptions AT&T does not want or need, or risk widespread network outages,” AT&T reckons.

In its lawsuit, AT&T claims “bullying tactics” were expected from Broadcom post-acquisition. Quoting Ars Technica reporting, the lawsuit claims that “Broadcom wasted no time strong-arming customers into highly unfavorable subscription models marked by ‘steeply increased prices[,]’ ‘refusing to maintain security conditions for perpetual license[d] [software,]’ and threatening to cut off support for existing products already licensed by customers—exactly as it has done here.'”

“Without the Support Services, the more than 75,000 virtual machines operated by AT&T⸺impacting millions of its customers worldwide⸺would all be just an error or software glitch away from failing,” AT&T’s lawsuit says.

Broadcom’s response

In the lawsuit, Broadcom alleges that AT&T is not eligible to renew support services for a year because it believes AT&T was supposed to renew all three one-year support service plans by the end of 2023.

In a statement to Ars Technica, a Broadcom company spokesperson said:

Broadcom strongly disagrees with the allegations and is confident we will prevail in the legal process. VMware has been moving to a subscription model, the standard for the software industry, for several years – beginning before the acquisition by Broadcom. Our focus will continue to be providing our customers choice and flexibility while helping them address their most complex technology challenges.

Communications for Office of the President, first responders could be affected

AT&T’s lawsuit emphasizes that should it lose support for VMware offerings, communications for the Office of the President and first responders would be at risk. AT&T claims that about 22,000 of its 75,000 VMs relying on VMware “are used in some way to support AT&T’s provision of services to millions of police officers, firefighters, paramedics, emergency workers and incident response team members nationwide… for use in connection with matters of public safety and/or national security.”

When reached for comment, AT&T’s spokesperson declined to comment on AT&T’s backup plan for minimizing disruption should it lose VMware support in a few days.

Ultimately, the case centers on “multiple documents involved, and resolution of the dispute will require interpretation as to which clauses prevail,” Benjamin B. Kabak, a partner practicing in technology and outsourcing at the Loeb & Loeb LLP New York law firm, points out.

AT&T sues Broadcom for refusing to renew perpetual license support Read More »

Hackers exploit VMware vulnerability that gives them hypervisor admin

Biz & IT, hypervisor, ransomware, Security, vmware / Mike M. / July 29, 2024

AUTHENTICATION NOT REQUIRED —

Create new group called “ESX Admins” and ESXi automatically gives it admin rights.

Dan Goodin – Jul 29, 2024 9: 02 pm UTC

Microsoft is urging users of VMware’s ESXi hypervisor to take immediate action to ward off ongoing attacks by ransomware groups that give them full administrative control of the servers the product runs on.

The vulnerability, tracked as CVE-2024-37085, allows attackers who have already gained limited system rights on a targeted server to gain full administrative control of the ESXi hypervisor. Attackers affiliated with multiple ransomware syndicates—including Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest—have been exploiting the flaw for months in numerous post-compromise attacks, meaning after the limited access has already been gained through other means.

Admin rights assigned by default

Full administrative control of the hypervisor gives attackers various capabilities, including encrypting the file system and taking down the servers they host. The hypervisor control can also allow attackers to access hosted virtual machines to either exfiltrate data or expand their foothold inside a network. Microsoft discovered the vulnerability under exploit in the normal course of investigating the attacks and reported it to VMware. VMware parent company Broadcom patched the vulnerability on Thursday.

“Microsoft security researchers identified a new post-compromise technique utilized by ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest in numerous attacks,” members of the Microsoft Threat Intelligence team wrote Monday. “In several cases, the use of this technique has led to Akira and Black Basta ransomware deployments.”

The post went on to document an astonishing discovery: escalating hypervisor privileges on ESXi to unrestricted admin was as simple as creating a new domain group named “ESX Admins.” From then on, any user assigned to the domain—including newly created ones—automatically became admin, with no authentication necessary. As the Microsoft post explained:

Further analysis of the vulnerability revealed that VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named “ESX Admins” to have full administrative access by default. This group is not a built-in group in Active Directory and does not exist by default. ESXi hypervisors do not validate that such a group exists when the server is joined to a domain and still treats any members of a group with this name with full administrative access, even if the group did not originally exist. Additionally, the membership in the group is determined by name and not by security identifier (SID).

Creating the new domain group can be accomplished with just two commands:

net group “ESX Admins” /domain /add
net group “ESX Admins” username /domain /add

They said over the past year, ransomware actors have increasingly targeted ESXi hypervisors in attacks that allow them to mass encrypt data with only a “few clicks” required. By encrypting the hypervisor file system, all virtual machines hosted on it are also encrypted. The researchers also said that many security products have limited visibility into and little protection of the ESXi hypervisor.

The ease of exploitation, coupled with the medium severity rating VMware assigned to the vulnerability, a 6.8 out of a possible 10, prompted criticism from some experienced security professionals.

ESXi is a Type 1 hypervisor, also known as a bare-metal hypervisor, meaning it’s an operating system unto itself that’s installed directly on top of a physical server. Unlike Type 2 hypervisors, Type 1 hypervisors don’t run on top of an operating system such as Windows or Linux. Guest operating systems then run on top. Taking control of the ESXi hypervisor gives attackers enormous power.

The Microsoft researchers described one attack they observed by the Storm-0506 threat group to install ransomware known as Black Basta. As intermediate steps, Storm-0506 installed malware known as Qakbot and exploited a previously fixed Windows vulnerability to facilitate the installation of two hacking tools, one known as Cobalt Strike and the other Mimikatz. The researchers wrote:

Earlier this year, an engineering firm in North America was affected by a Black Basta ransomware deployment by Storm-0506. During this attack, the threat actor used the CVE-2024-37085 vulnerability to gain elevated privileges to the ESXi hypervisors within the organization.

The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices. The threat actor then used Cobalt Strike and Pypykatz (a Python version of Mimikatz) to steal the credentials of two domain administrators and to move laterally to four domain controllers.

On the compromised domain controllers, the threat actor installed persistence mechanisms using custom tools and a SystemBC implant. The actor was also observed attempting to brute force Remote Desktop Protocol (RDP) connections to multiple devices as another method for lateral movement, and then again installing Cobalt Strike and SystemBC. The threat actor then tried to tamper with Microsoft Defender Antivirus using various tools to avoid detection.

Microsoft observed that the threat actor created the “ESX Admins” group in the domain and added a new user account to it, following these actions, Microsoft observed that this attack resulted in encrypting of the ESXi file system and losing functionality of the hosted virtual machines on the ESXi hypervisor. The actor was also observed to use PsExec to encrypt devices that are not hosted on the ESXi hypervisor. Microsoft Defender Antivirus and automatic attack disruption in Microsoft Defender for Endpoint were able to stop these encryption attempts in devices that had the unified agent for Defender for Endpoint installed.

Enlarge / The attack chain used by Storm-0506.

Microsoft

Anyone with administrative responsibility for ESXi hypervisors should prioritize investigating and patching this vulnerability. The Microsoft post provides several methods for identifying suspicious modifications to the ESX Admins group or other potential signs of this vulnerability being exploited.

Hackers exploit VMware vulnerability that gives them hypervisor admin Read More »

VMware customers may stay, but Broadcom could face backlash “for years to come”

Amazon, Amazon Web Services, Biz & IT, Broadcom, vmware / Paul Patrick / June 7, 2024

“The emotional shock has started to metabolize” —

300 director-level IT workers making VMware decisions were questioned.

Scharon Harding – Jun 7, 2024 2: 24 pm UTC

After acquiring VMware, Broadcom swiftly enacted widespread changes that resulted in strong public backlash. A new survey of 300 director-level IT workers at companies that are customers of North American VMware provides insight into the customer reaction to Broadcom’s overhaul.

The survey released Thursday doesn’t provide feedback from every VMware customer, but it’s the first time we’ve seen responses from IT decision-makers working for companies paying for VMware products. It echos concerns expressed at the announcement of some of Broadcom’s more controversial changes to VMware, like the end of perpetual licenses and growing costs.

CloudBolt Software commissioned Wakefield Research, a market research agency, to run the study from May 9 through May 23. The “CloudBolt Industry Insights Reality Report: VMware Acquisition Aftermath” includes responses from workers at 150 companies with fewer than 1,000 workers and 150 companies with more than 1,000 workers. Survey respondents were invited via email and took the survey online, with the report authors writing that results are subject to sampling variation of ±5.7 percentage points at a 95 percent confidence level.

Notably, Amazon Web Services (AWS) commissioned the report in partnership with CloudBolt. AWS’s partnership with VMware hit a road bump last month when Broadcom stopped allowing AWS to resell the VMware Cloud on AWS offering—a move that AWS said “disappointed it.” Kyle Campos, CloudBolt CTPO, told Ars Technica that the full extent to which AWS was involved in this report was helping underwrite the cost of research. But you can see why AWS would have interest in customer dissatisfaction with VMware.

Widespread worry

Every person surveyed said that they expect VMware prices to rise under Broadcom. In a March “User Group Town Hall,” attendees complained about “price rises of 500 and 600 percent,” according to The Register. We heard in February from ServeTheHome that “smaller” cloud service providers were claiming to see costs grow tenfold. In this week’s survey, 73 percent of respondents said they expect VMware prices to more than double. Twelve percent of respondents expect a price hike of 301 to 500 percent. Only 1 percent anticipate price hikes of 501 to 1,000 percent.

“At this juncture post-acquisition, most larger enterprises seem to have a clear understanding of how their next procurement cycle with Broadcom will be impacted from a pricing and packaging standpoint,” the report noted.

Further, 95 percent of survey respondents said they view Broadcom buying VMware as disruptive to their IT strategy, with 46 percent considering it extremely or very disruptive.

Widespread concerns about cost and IT strategy help explain why 99 percent of the 300 respondents said they are concerned about Broadcom owning VMware, with 46 percent being “very concerned” and 30 percent “extremely concerned.”

Broadcom didn’t respond to Ars’ request for comment.

Not jumping ship yet

Despite widespread anxiety over Broadcom’s VMware, most of the respondents said they will likely stay with VMware either partially (43 percent of respondents) or fully (40 percent). A smaller percentage of respondents said they would move more workloads to the public cloud (38 percent) or a different hypervisor (34 percent) or move entirely to the public cloud (33 percent). This is with 69 percent of respondents having at least one contract expiring with VMware within the next 12 months.

Many companies have already migrated easy-to-move workloads to the public cloud, CloudBolt’s Campos said in a statement. For many firms surveyed, what’s left in the data center “is a mixture of workloads requiring significant modernization or compliance bound to the data center,” including infrastructure components that have been in place for decades. Campos noted that many mission-critical workloads remain in the data center, and moving them is “daunting with unclear ROI.”

“The emotional shock has started to metabolize inside of the Broadcom customer base, but it’s metabolized in the form of strong commitment to mitigating the negative impacts of the Broadcom VMware acquisition,” Campos told Ars Technica.

Resistance to ditching VMware reflects how “embedded” VMware is within customer infrastructures, the CloudBolt exec told Ars, adding:

In many cases, the teams responsible for purchasing, implementing, and operating VMware have never even considered an alternative prior to this acquisition; it’s the only operating reality they know and they are used to buying out of this problem.

Top reasons cited for considering abandoning VMware partially or totally were uncertainty about Broadcom’s plans, concerns about support quality under Broadcom, and changes to relationships with channel partners (each named by 36 percent of respondents).

Following closely was the shift to subscription licensing (34 percent), expected price bumps (33 percent), and personal negative experiences with Broadcom (33 percent). Broadcom’s history with big buys like Symantec and CA Technologies also has 32 percent of people surveyed considering leaving VMware.

Although many firms seem to be weighing their options before potentially leaving VMware, Campos warned that Broadcom could see backlash continue “for months and even years to come,” considering the areas of concern cited in the survey and how all VMware offerings are near-equal candidates for eventual nixing.

VMware customers may stay, but Broadcom could face backlash “for years to come” Read More »

VMware Fusion, Workstation now free for home use, subscription-only for businesses

Broadcom, Tech, vmware / Rejus Almole / May 15, 2024

i’ve got good news and bad news —

Free for personal use, but businesses will have to fork over $120 per year.

Andrew Cunningham – May 15, 2024 3: 45 pm UTC

Broadcom’s acquisition of VMware last year has led to widespread upheaval at the company, including layoffs, big changes to how it approaches software licensing, and general angst from customers and partners. Broadcom also discontinued the free-to-use version of VMware’s vSphere Hypervisor, also known as ESXi, earlier this year, forcing home users to find alternatives.

But today there’s a bit of good news—for home users, at least. Broadcom is making VMware Fusion Pro 13 and VMWare Workstation Pro free for personal use.

Fusion Pro and Workstation Pro certainly aren’t the only free-to-use virtualization products—VirtualBox has existed for years, and there are many indie projects that make use of Apple’s virtualization frameworks for macOS. But VMware’s products are a bit more polished and easier to learn than some of those alternatives, and VMware’s file formats are also commonly used when redistributing virtual machines for retrocomputing purposes.

Today’s announcement may be less welcome for businesses that prefer perpetually licensed versions of Fusion Pro or Workstation Pro. VMware is phasing these licenses out, offering support for current perpetually licensed products until “their existing End of Life and End of General Support dates” but shifting to a subscription-only model for future updates.

VMware is framing this as a “simplification” that “eliminates 40+ other SKUs,” and while this may be true, it’s also likely just a side effect of Broadcom’s wider push to end standalone software sales in favor of a more lucrative subscription-only model. Broadcom has already stopped selling perpetual licenses for many other VMware products.

A Desktop Hypervisor app subscription will run businesses $120 per year. The only difference between the free home version and the paid business version is a “this product is licensed for personal use only” message that appears in the home version; Broadcom says that the products are functionally identical.

Since the full apps are going the free-to-use route, Broadcom is discontinuing the VMware Workstation Player and Fusion Player apps. These apps could be used to fire up pre-existing VMs but generally couldn’t create new virtual machines from scratch. Workstation Player will continue on as a component of Workstation Pro, but it will no longer be offered as a standalone product. Users of Fusion Player will be able to upgrade in place to Fusion Pro by updating the app to version 13.5.2 or later and deleting the Fusion Player license key. Workstation Player users will need to download and install the Workstation Pro software separately.

Users who want to use Fusion Pro and Workstation Pro will need to sign up for a Broadcom account; once they do, Fusion Pro can be downloaded from here, and Workstation Pro can be downloaded from here.

VMware Fusion, Workstation now free for home use, subscription-only for businesses Read More »

Broadcom says “many” VMware perpetual licenses got support extensions

antitrust, Biz & IT, Broadcom, Europe, European Commission, vmware / Mike M. / April 18, 2024

Conveniently timed blog post —

Broadcom reportedly accused of changing VMware licensing and support conditions.

Scharon Harding – Apr 17, 2024 4: 44 pm UTC

Broadcom CEO Hock Tan this week publicized some concessions aimed at helping customers and partners ease into VMware’s recent business model changes. Tan reiterated that the controversial changes, like the end of perpetual licensing, aren’t going away. But amid questioning from antitrust officials in the European Union (EU), Tan announced that the company has already given support extensions for some VMware perpetual license holders.

Broadcom closed its $69 billion VMware acquisition in November. One of its first moves was ending VMware perpetual license sales in favor of subscriptions. Since December, Broadcom also hasn’t sold Support and Subscription renewals for VMware perpetual licenses.

In a blog post on Monday, Tan admitted that this shift requires “a change in the timing of customers’ expenditures and the balance of those expenditures between capital and operating spending.” As a result, Broadcom has “given support extensions to many customers who came up for renewal while these changes were rolling out.” Tan didn’t specify how Broadcom determined who is eligible for an extension or for how long. However, the executive’s blog is the first time Broadcom has announced such extensions and opens the door to more extension requests.

Tan also announced free access to zero-day security patches for supported versions of vSphere to “ensure that customers whose maintenance and support contracts have expired and choose to not continue on one of our subscription offerings are able to use perpetual licenses in a safe and secure fashion.” Tan said other VMware offerings would also receive this concession but didn’t say which or when.

Antitrust concerns in the EU

The news follows Broadcom being questioned by EU antitrust regulators. In late March, MLex said that a European Commission spokesperson had contacted Broadcom for questioning because the commission “received information suggesting that Broadcom is changing the conditions of VMware’s software licensing and support.” Reuters confirmed the news on Monday, the same day Tan posted his blog. Tan didn’t specify if his blog post was related to the EU probing. Broadcom moving VMware to a subscription model was one of the allegations that led to EU officials’ probe, MLex said last month. It’s unclear what, if anything, will follow the questioning.

Tan said this week that VMware’s plan to move to a subscription model started in 2018 (he previously said the plans started to “accelerate in 2019”) before Broadcom’s acquisition. He has argued that the transition ultimately occurred later than most competitors.

The Commission previously approved Broadcom’s VMware purchase in July after a separate antitrust investigation.

However, various European trade groups, including Beltug, a Belgian CIO trade group, and the CIO Platform Nederland association for CIOs and CDOs, wrote a letter (PDF) to the European Commission on March 28, requesting that the Commission “take appropriate action” against Broadcom, which it accused of implementing VMware business practices that resulted in “steeply increased prices,” “non-fulfillment of previous contractual agreements,” and Broadcom “refusing to maintain security conditions for perpetual licenses.”

Partner worries

VMware channel partners and customers have also criticized Broadcom’s VMware for seemingly having less interest in doing business with smaller businesses. The company previously announced that it is killing the VMware Cloud Services Provider (CSP) partner program. The Palo Alto-headquartered firm originally said that CSPs may be invited to the Broadcom Expert Advantage Partner Program. However, reported minimum core requirements seemed to outprice small firms; in February, some small managed service providers claimed that the price of doing VMware business would increase tenfold under the new structure.

Small CSPs will be able to white-label offerings from larger CSPs that qualified for Broadcom’s Premier or Pinnacle partner program tiers as of April 30, when VMware’s CSP partner program shutters. But in the meantime, Broadcom “will continue existing operations” small CSPs “under modified monthly billing arrangements until the white-label offers are available,” Tan said, adding that the move is about ensuring that “there is continuity of service for this smaller partner group.”

However, some channel partners accessing VMware offerings through larger partners remain worried about the future. CRN spoke with an anonymous channel partner selling VMware through Hewlett Packard Enterprise (HPE), which said that more than half of its VMware customers “have reached out to say they are concerned and they want to be aware of alternatives.”

Another unnamed HPE partner told CRN that Broadcom’s perceived prioritization of “the “bigger, more profitable customers, is sensible but “leaves a lot of people in the lurch.”

Broadcom didn’t respond to Ars’ request for comment.

Broadcom says “many” VMware perpetual licenses got support extensions Read More »