[ovirt-users] KSM and cross-vm attack

[Jorick Astrego]

Hi Sven,

Thanks for you response, I will read some more.

But as you say it has been known for a while and I was aware of it for 
many years although never diving into the specifics. I always thought it 
was not a practical attack vector

What caught my attention was that it was so fast it can be done in less 
then a minute:

    Lightning-Fast Attack: *Even in the worst case scenario (cross-VM)
    the attack**
    **succeeds in less than a minute. To the best of our knowledge, no
    faster attack**
    **has been implemented against AES in a realistic cloud-like
    setting. This also**
    **means that just one minute of co-location with the encryption
    server suffices to**
    **recover the key.*


> For the most parts, it's easier to hack you machine directly
> or social-engineer your way into it, than it is to hack/get
> access to a different vm on the same system and than hack another vm.

So that was the part that worries me, if I have a public cloud offering 
and someone doesn't hack a vm but simply rents one. He can then spawn a 
new VM every couple of minutes and it will probably be on a different 
host each time..... with different neighbours.

You could hack every vulnerable customer VM in a couple of hours this 
way and it would all be undetected.

> There are also still no automatic tools for this, which I'm aware of
> (if they are, I'd like to be pointed to them).
>
> As soon as automatic attack tools will cover this scenario I'm pretty
> sure we'll see an increase in hacked vms and sniffed private keys.
I'm sure there are automatic tools being built as we speak but they will 
not be generally available.


Kind regards,

Jorick Astrego
Netbulae B.V.



On 06/13/2014 09:38 AM, Sven Kieske wrote:
> Hi,
>
> it's kind of you to let those know
> about these attacks who do not already know them, but
> this should be well understood by every professional by know.
>
> Shared resources are never secure, if you
> can not control the access from third parties
> to shared memory.
>
> this does not just affect KSM (or similar
> techniques from vmware, xen and microsoft)
> but also L3-Caches of modern CPUs.
>
> If you are interested in these topics, here are some papers:
>
> L3-Side-Channel attack to recover private
> GPG-Keys from another VM:
>
> http://eprint.iacr.org/2013/448.pdf
>
> Correlation attack against openssl,
> polarssl and libgcrypt on xen and vmware:
>
> https://eprint.iacr.org/2014/248.pdf
>
> I don't know if IBMs PowerVM is vulnerable to such
> attacks, as it's LPAR architecture is certified
> EAL 4+ (which might not tell anything about this attack
> vector).
>
> But you always need to have in mind, what attack
> scenario you talk about:
>
> These attacks are about a malicious vm (this could be a
> hacked/hijacked vm) which recovers parts of the shared memory
> from a known other instance to attack.
>
> if you have high security concerns you might want _not_
> to share your physical server with third party controlled
> vms, or with vms which might be the target of getting hacked
> (or which runs software, which is known to be vulnerable).
>
> I still consider this scenario not as that relevant today, as
> there are many more low hanging fruits (sadly).
>
> This means in short:
>
> For the most parts, it's easier to hack you machine directly
> or social-engineer your way into it, than it is to hack/get
> access to a different vm on the same system and than hack another vm.
>
> There are also still no automatic tools for this, which I'm aware of
> (if they are, I'd like to be pointed to them).
>
> As soon as automatic attack tools will cover this scenario I'm pretty
> sure we'll see an increase in hacked vms and sniffed private keys.
>
>
> HTH
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ovirt.org/pipermail/users/attachments/20140613/ddcd12b2/attachment-0001.html>