Old and new topics in security Paper type 1: new idea, never been 8271 discussion of: “Hey, You, Get Off of My done before Cloud: Exploring Information Leakage in Main contribution is novelty Incentive to be first, maybe even a race Third-Party Compute Clouds” Paper type 2: improvement in an Stephen McCamant (Original paper: Thomas Ristenpart, Eran already-busy area Tromer, Hovav Shacham, and Stefan Savage) University of Minnesota (Original paper: UC San Diego and MIT) Contributions judged differentially Incentive to optimize Cloud threats, old and new Case study: Amazon EC2 Largest, highest-profile infrastructure Old: your system’s regular vulnerabilities cloud provider New but understood: need to trust World-spanning data centers, instance cloud provider sizes $0.02-$6.82 per hour Focus here: attacks from cloud Many instance types use Xen to neighbors multiplex one physical machine Ethical/legal sidebar Placement and extraction Important for academic researchers to Placement : get an instance on the do things “by the book” same physical machine as the victim Ethical obligations may be greater or Extraction : given placement, get less than legal ones confidential info Here: CFAA, EC2 user agreement
Network probing Network mapping Internal addresses reflect topology TCP traceroutes, port 80 and 443 scans, DNS resolution Disjoint by availability region, clustered by instance type Instances have one name, but separate public and internal IP addresses Dom0s in an adjacent block Network-based co-residence checks Hard disk usage channel Dom0 in traceroute (easiest) Measure contention for hard disk (e.g., Close IP addresses seek times) between VMs Smallest packet round-trip times “No attempt to optimize” bandwidth: 0.0005 bits/sec (33 mins per bit) All found to have “effectively zero” false Why so slow? positives Covert channels and side channels Observed placement locality “Covert channel”: generally send and Sequential locality: new instance likely receiver cooperate to use same machine as old dead one One classification: storage channels, timing channels Parallel locality: instances started close “Side channel”: “sender” is passive in time more likely to share victim Non-locality: one account never given Can again include timing, also error two instances on same machine messages, power usage, etc.
Evaluating brute-force placement Using locality Idea: use parallel locality, try to start Chose 1686 victims probes soon after victim Small instances in zone 3 with public web Perhaps can trigger victim start, such as if servers it’s based on demand Launched probe instances and checked About 40% coverage for 20 victims co-residence and 20 probes 510 probes: hit 127 victims Also demonstrated against demos of 1785 probes: hit 141 victims, 8.4% commercial services Cache: Prime ✰ Trigger ✰ Probe Load and traffic estimation 1. (Prime) Fill cache with my data 2. Busy loop until preempted (recognize Check for co-residence using system with TSC) load as a covert channel 3. Measure time to re-read my data Estimate traffic load on co-resident web Must play tricks to defeat CPU server pre-fetch Differential coding to resist noise Keystroke timing attack (classic) Keystrokes in Xen Lab installation with CPU pinning, Fine-grained keystroke timing can otherwise idle; not real EC2 reveal information about text typed Threshold cache activity level Especially given per-user training More than idle, less than otherwise busy Demonstrated in lab against passwords 5% false negatives, 0.3 false positives typed over SSH, without breaking per second crypto Timing resolution 13ms, enough for prior 50 ✂ speedup over exhaustive search attacks
Countermeasures: limited Countermeasure: pay for isolation Randomize and isolate network Pay extra to have machines all to structure yourself Timing measurements still possible Argument: fair cost upper-bounded by Block or add noise to covert channels cost of one physical machine Hard, and how to know you have them all? Not implemented Avoid locality in placement algorithm Though compare: GovCloud Reduces but does not eliminate attacks
Recommend
More recommend
