Amazon downplays report highlighting vulnerabilities in its cloud service
Hypothetical example described in report much harder to pull off in reality, company says
Computerworld - Amazon said today that it has taken steps to mitigate a security issue in its cloud computing infrastructure that was identified recently by researchers from MIT and the University of California at San Diego.
The report described how attackers could search for, locate and attack specific targets in Amazon's Elastic Computer Cloud (EC2) because of certain underlying vulnerabilities in the infrastructure.
Though the attack described in the report was conducted against Amazons infrastructure, the researchers concluded that similar targeted attacks could be carried out in other cloud services as well because the vulnerabilities were generic.
In response, Amazon spokeswoman Kay Kinton said today that the report describes cloud cartography methods that could increase an attacker's probability of launching a rogue virtual machine (VM) on the same physical server as another specific target VM.
What remains unclear, however, is how exactly attackers would be able to use that presence on the same physical server to then attack the target VM, Kinton told Computerworld via e-mail.
The research paper itself described how potential attackers could use so-called "side-channel" attacks to try and try and steal information from a target VM. The researchers had argued that a VM sitting on the same physical server as a target VM, could monitor shared resources on the server to make highly educated inferences about the target VM.
By monitoring CPU and memory cache utilization on the shared server, an attacker could determine periods of high-activity on the target servers, estimate high-traffic rates and even launch keystroke timing attacks to gather passwords and other data from the target server, the researchers had noted.
Such side-channel attacks have proved highly successful in non-cloud contexts, so there's no reason why they shouldn't work in a cloud environment, the researchers postulated.
However, Kinton characterized the attack described in the report as "hypothetical," and one that would be "significantly more difficult in practice."
"The side channel techniques presented are based on testing results from a carefully controlled lab environment with configurations that do not match the actual Amazon EC2 environment," Kinton said.
"As the researchers point out, there are a number of factors that would make such an attack significantly more difficult in practice," she said.
At the same time, Amazon takes all reports of vulnerabilities in its cloud infrastructure very seriously, she said. The company will continue to investigate potential exploits thoroughly and continue to develop features bolster security for users of its cloud service, she said.
Amazon Web Services has already rolled out safeguards that prevent potential attackers from using the cartography techniques described in the paper, Kinton said without offering any details.
She also pointed to the recently launched Amazon Web Service Multi-Factor Authentication (AWS MFA) as another example of the company's continuing effort to bolster cloud security. AWS MFA is designed to provide an extra layer access control to a customer's Web services account, Kinton said.
The research report that highlighted the security issues in cloud computing infrastructures is scheduled to be presented at the ACM Conference on Computer and Communications Security next month.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!