Cloud services Security Talk: Side-road attack threat

I've written some articles about security, so I'm interested in "cloud services" or "time-sharing," and my predecessors thought they were safe. Almost from the beginning, there was a constant talk of how the cloud services were convenient, and cloud services attracted my attention.

Since when is it convenient to be a bad thing? This is not normal, but in the digital world, the current ideology is the opposite of the two poles of convenience and security. I liken it to a mixture of water and oil. They will mix together after a hard shake, but after a while they will be separated.

I am often asked to view the cloud services. However, I politely rejected any comments about current cloud service support and objections because there is no real point in discussing security and cloud services. So far, the two have not received any strong support evidence.

The first flaw

As I mentioned, I've been looking for all the clues about the security of cloud services. So far, the investigation of these clues has come to a dead end. I learned from a team of investigators that they found a vulnerability that could be exploited, and that it would threaten the security of the data if it resided in a cloud service.

I'm worried that this is the real situation. The team member Ari Juels (RSA Security Laboratory), Alinaoprea (RSA Security Laboratory), Michael Reiter (University of North Carolina at Chapel Hill), Thomas Ristenpart (University of Wisconsin-Madison) and Yinqian Zhang (University of North Carolina at Chapel Hill) have done enough research to support the many academic papers they have published and demonstrate their ability to obtain private keys from cloud services. ("HomeAlone Software: Analysis of coexistence detection in cloud services through a side-channel attack method" and "cross-virtual side-Path attack methods and access to private keys").

I'm not going to let this chance slip away like this. I got in touch with Dr. Juels and he agreed to answer the questions I asked. But first, I want to think about how to make the most appropriate definition of cloud services (refer to Wikipedia):

Cloud computing services are based on the network (usually the Internet), using computer resources (hardware and software) as a way of serving. The name uses a cloud symbol as an abstract concept that contains a complex infrastructure in this system graph. Cloud computing is used to host data, software, and computing services for users.

Dr. Kassner:juels, cloud services cover a number of areas. In order to let us know your research results, please explain what you are concerned about?

Dr. Juels: I think the term is defined fairly broadly, but the question of security should be emphasized. Many of the security implications of cloud computing applications arise from the hosting of resources to third party clients, which in the past have been able to be controlled.

The results of controllable and visible loss result in a wide range of security issues. Other security threats come from the centralization of cloud services, which has led to a large number of attackers being attracted to cloud computing. But centralization is not without merit.

Kassner: Using multiple virtual machines (VMS) on a single physical server is an important reason for economic viability. In your first opinion and research paper, talking about sharing on a physical server is considered to be trouble. Why is that?

Dr. Juels: Virtual machines Create a relatively isolated environment between neighborhoods. This is an abstract convenience, but it masks an important reality: sharing hardware means sharing information unintentionally. This may not be a problem for low security applications, but customers need to understand the risks of this architecture.

Kassner: To verify that the virtual machines on the server are at risk, you and your team have created a homealone software. About HomeAlone Software, the research paper points out:

The core idea of HomeAlone is to reverse the application of side-channel attack. Instead of exploiting the vulnerability of a bypass attack as an attack source, HomeAlone uses a bypass (in the L2 cache) as a new, defensive detection tool.

What is a side road? Could you please explain how HomeAlone works?

Dr. Juels: The so-called bypass is a by-product of system design that can cause information to leak, not a function of its own. For example, if two virtual machines share a cache, one of the virtual machines can infer information by detecting traces of another virtual machine. Although this cache is not designed to transmit information between virtual machines, this is possible.

Kassner: No one seems to believe the seriousness of the side-road attack. To do this, you created an attack to prove it. What's the result?

Dr Juels: For a long time, security experts speculated that some sensitive information between virtual machine boundaries could be compromised, but it was not actively demonstrated. We have demonstrated their intuitive sensitivity. Under normal circumstances, we have demonstrated that a virtual machine that exists in the same server can use the attack software to steal the encryption key from another VM. In other words, the attack software can disrupt the isolation boundaries between virtual machines and seriously damage the interests of the victims.

Kassner: One of the things that we are always accused of, the things that are established and proved in the laboratory, are completely different from the actual situation. Can this be understood? Do you agree with this statement? What is the actual situation?

Dr. Juels: The kind of attack we show is hard to achieve. Yinqian Zhang completes this operation, he has a deeper understanding of the side-channel attacks in the virtual environment, and spends a lot of time and creativity to complete the work. In a nutshell, if you don't have a more direct understanding of side-channel attacks, you may need to work on securing your computer's resources.

I suspect, then, that the side-road attack has the ability to undermine national security, an attack that can easily be overlooked. In addition, once this attack tool is available, the tool becomes commercialized. With the development of the Seismic Network (Stuxnet) worm, a senior professional team may be needed to address it, and malware writers will learn a lot from it and use the technology. Side-channel attacks are a real problem, and some of these techniques have been adopted, such as smart cards.

Kassner: If you were to install a cloud service for a company, what would you expect the cloud service provider to do? Would you give any other advice to companies interested in cloud services?

Dr. Juels: This moment can be called Hobson's Choice (Hobson's Choice: no choice). I will call for better standards and procedures in the industry to achieve visibility and control. Similar to the SSAE 16 certification by the American Institute of Chartered Accountants (AICPA) for the internal controls, safeguards, and audit standards for services provided to customers by service providers (Statement on standards for attestation Engagements No. 16 is far from sufficient for the so-called security guarantees offered by cloud service providers.

Instead of just browsing the checklist on the data center's WordPad, customers need real-time, highly trusted services for cloud security. A stronger customer demand for security and a combination of new technologies to ensure more and more focused and critical cloud services infrastructures will benefit the industry as a whole.

Dr. Kassner:juels, I'd like to hear your opinion. It is often discussed how to ensure the security of cloud services. You have done an in-depth study of it. What do you feel about the topic?

Dr. Juels: The most important thing is that no one really understands the seriousness of the problem. As I mentioned, cloud service providers do not need or are prepared to guarantee the security of the services they provide, which in itself should be the corresponding responsibility they should assume. My impression is that most cloud service providers are serious about securing security, but it's not enough just to have a vague attitude.

Often every new industry needs to thoroughly understand the security lessons of its predecessors and to treat security as an afterthought. The reason I'm bullish on cloud computing services is that security has been a concern from the outset, compared to many previous examples.

Conclusion

It seems to be a layer of window paper that breaks in a poke. Similar to many other sophisticated attack software, it will soon be monetization, seemingly a good choice. I would like to reiterate what Dr. Juels mentioned:

Cloud service providers do not need or are prepared to guarantee the security of the services they provide, which in itself should be the corresponding responsibility they should assume.

In short, it is another case of "customer prudence".

I would like to thank the research team for their efforts and, in particular, to thank Dr. Juels for taking the time to explain the team's conclusions.