Paper: Exploring Information Leakage in Third-Party Compute Clouds
At the end of last year, people from the University of California and MIT published an extremely interesting 14-pages paper about the risks of information leakage in multi-tenancy Infrastructure-as-a-Service (IaaS) clouds.
Titled Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds, it was presented at the ACM Conference on Computer and Communications Security 2009.
The research mentions The Rackspace Cloud (formerly Mosso), Microsoft Windows Azure, even if it doesn’t seem yet a IaaS platform, but it primarily focuses on Amazon Elastic Computing Cloud (EC2) describing how attack a target virtual machine inside the cloud in four phases:
- map the cloud provider’s internal infrastructure (“cloud cartography”)
- identify the attack target position
- place a hostile virtual machine in the same host of the target virtual machine
- perform side-channel attacks leveraging the shared resources
The paper claims that “investing just a few dollars in launching VMs, there’s a 40% chance of placing a malicious VM on the same physical server as a target customer”.
It ends with a number of suggestions to mitigate the risks:
First, cloud providers may obfuscate both the internal structure of their services and the placement policy to complicate an adversary’s attempts to place a VM on the same physical machine as its target. For example, providers might do well by inhibiting simple network-based co-residence checks.
However, such approaches might only slow down, and not entirely stop, a dedicated attacker. Second, one may focus on the side-channel vulnerabilities themselves and employ blinding techniques to minimize the information that can be leaked. This solution requires being confident that all possible side-channels have been anticipated and blinded. Ultimately, we believe that the best solution is simply to expose the risk and placement decisions directly to users. A user might insist on using physical machines populated only with their own VMs and, in exchange, bear the opportunity costs of leaving some of these machines under-utilized. For an optimal assignment policy, this additional overhead should never need to exceed the cost of a single physical machine, so large users—consuming the cycles of many servers—would incur only minor penalties as a fraction of their total cost.
virtualization.info Newest articles
May 22nd, 2012
Yesterday, during its annual conference in Las Vegas, EMC announced the acquisition of Syncplicity, a cloud-storage privately held startup founded in 2008 and based in Menlo Park, California.
Terms…
May 21st, 2012
On May 18th Oracle announced the general availability of version 3.1 of its x86 enterprise virtualization solution VM Server.
This release follows 3.0 announced on August 24th 2011.
All the new…
May 21st, 2012
In this post, published on May 18 in VROOM! Blog, the VMware’s Performance Team presented some of the most significant enhancements and optimizations brought to Teradici‘s PCoIP protocol in the…
May 17th, 2012
On May 15th NVIDIA unveiled the NVIDIA® VGX™ platform that will be available later this year through NVIDIA’s hardware OEM and VDI partners.
This new platform promises to deliver…
May 17th, 2012
Microsoft announced this week the new Beta version of its capacity planning tool Microsoft Assessment and Planning (MAP) 7.0 Beta.
The Beta program opened on May 15th and the review…
May 15th, 2012
Today VMware announced VMware vFabric Suite 5.1, expected to be generally available in Q2 2012.
vFabric Suite 5.1 includes vFabric Application Director, to automate the deployment and management of vFabric…
May 15th, 2012
On April 4 Stephen Herrod, VMware’s CTO, has attended, as guest speaker, at a VMUG meeting in Italy.
One of the key point of the speech, documented in one hour-long…
May 14th, 2012
Last week Citrix announced a new tech preview for Hosted Server VDI technology that allows cloud providers to leverage Microsoft SPLA to host VDI-style desktops obtaining a pay-as-you-go monthly subscription licensing…
May 11th, 2012
On May 7 Atlantis Computing announced the general availability of its Atlantis ILIO Diskless VDI 3.2, this product, tailored in particular for VMware View 5.1, enables virtual desktops deployment…
May 11th, 2012
On May 7 Citrix announced a technology preview of Project Aruba that extends Citrix VDI all-in-one proposal for the SMB market, VDI-in-a-Box, with personal vDisk technology.
VDI-in-a-Box, inherited from Kaviza…
May 10th, 2012
On May 7 Cloud Sidekick announced the Early Access Program release of Cato Enterprise Edition (EE) which extends the Community Edition (CE) with Storm Deployment Automation and support for…
May 9th, 2012
On April 26 VMware announced the general availability of VMware vCenter Infrastructure Navigator (VIN) 1.1, previously introduced as a part of vCenter Operations Management Suite.
VIN automatically detects, discovers and…
May 8th, 2012
On May 3 VMware released a security update, that the company itself define as “accelerated“, with the purpose to patch five “critical” security issues across VMware ESX and ESXi hypervisor…
May 7th, 2012
On May 3 VMware announced it has joined the Facebook Open Compute Project, an initiative launched in 2011, with the objective of increase technology efficiencies and reduce the environmental impact…
Copyright © 2003-2012 virtualization.info. All rights reserved.
virtualization.info | cloudcomputing.info | virtualization.tv | Virtualization Congress