15

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure.

Possible vulnerable scenarios include

  • EMC SANs that promote/demote data from SATA to FLASH based on IOPS
  • A server that attempts to secure erase may not erase both locations of the promoted data
  • VMs that allocate space on demand on an expanding VMDK
  • Native OS APIs that can read raw partitions
  • IO errors that act as an Oracle to expose secrets
  • Storing the encrypted data and the key on the same VM (Bitlocker)
  • A variant of row hammer (a shared memory exploit) for disk IO Blocks

Possible mitigations might include

  • The server using a structured REST interface that hides subtle IO errors (e.g. I can't think of a way an Azure Cloud or Page blob can expose this)
  • On disk encryption managed by the OS (Bitlocker)
  • A hypervisor that automatically zeros out data upon release of the host

My goal is to come up with a checklist of sorts so I can investigate both the big names (Azure, Amazon, Rackspace, Google Apps, EMC, etc) but also independent niche shops for long tail scenarios.

Community
  • 1
makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • Are you asking about encrypted leak data (as the link mentions) or just any data shared between VMs? – RoraΖ May 22 '15 at 16:10
  • @raz Any shared disk based data ( opposed to RAM) – makerofthings7 May 22 '15 at 16:13
  • Since your information is within scope of third-party hosts: To prevent that issue, pre-encryption of any data sent to the third-party would likely be the only way to ensure a reliable level of safety regarding data leakage. Since you cannot absolutely know how data gets backed up, delta'd for snapshots, or anything like that on the third-party host, it's the only way to ensure that the data doesn't exist un-encrypted on a backup somewhere. – Desthro May 22 '15 at 19:06
  • 2
    @Desthro Absolutely certainty is practically never guaranteed. I think this question is about general practices in hypervisors across shared services like Amazon. – Steve Sether May 26 '15 at 21:09
  • 1
    I don't know if this is what you want to know, but i do full disk encryption on my servers. Nothing prevents the company who host your server to take a snapshot of your server and run it on another machine...so full disk encryption for me is a good practice. – Freedo Jul 01 '15 at 01:00

2 Answers2

2

Cloud providers can provide single tenant hardware so your VMs are isolated from other customers and clients. A number of financial regulators are expecting this to be enabled for confidential / regulated data when stored in the cloud.

For example, Amazon AWS has the concept of a 'dedicated instance' (link)

If you select this option your EC2 instances will be on dedicated hardware for your account, you of course pay a premium for this service with the benefit of reducing side channel attacks against your shared infrastructure at OS level.

fixulate
  • 788
  • 4
  • 9
1

It also depends on your storage system.

For example, if you have de-duplication, guest VMs may be able to establish whether known blocks of data are already stored, for example: (1) create a VM and store 10,000 reference files; (2) create another VM and store 30,000 files sampled without replacement from (A) the 10,000 reference files on VM 1, (B) 10,000 new reference files, and (C) 10,000 test files; (3) observe time for writing; (4) observe time for reading, repeat; (5) learn a model to predict membership in class A or B from the observed write and read times; (6) apply model to make predictions for files from set C; files that are predicted to belong to class A are likely to be already in the storage system; files predicted to belong to class B are likely to be fresh files.

Mitigation:

  • increase the size of the first level block storage so that de-duplication kicks in only after step 4
  • offer encryption (or opting-out of de-duplication) for VMs that need to protect their contents from this attack
  • encrypt untrusted VMs (or exclude them from de-duplication) so that they cannot attack the other VMs this way
Joachim Wagner
  • 171
  • 1
  • 5