Co-lo VMs busted by crypto attack

Powered by SC Magazine
 

Side-channel cache-sniffers steal keys.

Researchers have demonstrated a controlled attack in which private keys can be stolen from a virtualised machine.

The side-channel cryptographic attack was thought to be the first of its kind and could have serious consequences for cloud computing environments where an attacker is co-resident to a victim.

It was demonstrated in a paper (pdf) by researchers from the universities of North Carolina and Wisconsin along with security outfit RSA on a Xen-based virtualisation platform that replicated public cloud infrastructure.

RSA laboratories director Dr Ari Juels said while the attacks were made in a lab, there was “no reason to think that any public virtualised infrastructure is immune” from the attacks.

“The takeaway is this: VMs (virtualised machines) running highly sensitive workloads should not be placed on the same hosts as potentially untrustworthy VMs,” Juels said.

The attacks targeted a vulnerability in the cryptographic package libgcrypt used by GnuPG, which lacked defences against side-channel attacks.

Side-channel leaks were present in some crypto installations as a result of resource exposure.

“In our experiments, an attacker VM targets a co-resident victim VM running Gnu Privacy Guard,” Juels said.

“The attacker VM is able to steal the victim VM’s full private (ElGamal) key. In other words, the attack results in complete compromise of one form of encryption in GnuPG.”

The success of the attack in gaining the keys rendered obsolete existing beliefs that virtualisation, through the use of distinct operating systems, provided effective isolation and therefore security.

It did this by targeting shared hardware resources, specifically the L1 instruction cache, which revealed enough information based on alternate process execution between the target and attacker to build a crypto key.

Importantly, the access-driven side-channel attacks overcame challenges including hypervisor noise, core migration, and the “difficulty of preempting the victim with sufficient frequency to extract fine-grained information”.

While the attacks required a target and attacker to be co-resident on a single machine, earlier research (pdf) had shown it is possible to locate clients within cloud infrastructure.

Copyright © SC Magazine, Australia


Co-lo VMs busted by crypto attack
Credit
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 433

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 208

Vote