Co-lo VMs busted by crypto attack

Powered by SC Magazine

Side-channel cache-sniffers steal keys.

Researchers have demonstrated a controlled attack in which private keys can be stolen from a virtualised machine.

The side-channel cryptographic attack was thought to be the first of its kind and could have serious consequences for cloud computing environments where an attacker is co-resident to a victim.

It was demonstrated in a paper (pdf) by researchers from the universities of North Carolina and Wisconsin along with security outfit RSA on a Xen-based virtualisation platform that replicated public cloud infrastructure.

RSA laboratories director Dr Ari Juels said while the attacks were made in a lab, there was “no reason to think that any public virtualised infrastructure is immune” from the attacks.

“The takeaway is this: VMs (virtualised machines) running highly sensitive workloads should not be placed on the same hosts as potentially untrustworthy VMs,” Juels said.

The attacks targeted a vulnerability in the cryptographic package libgcrypt used by GnuPG, which lacked defences against side-channel attacks.

Side-channel leaks were present in some crypto installations as a result of resource exposure.

“In our experiments, an attacker VM targets a co-resident victim VM running Gnu Privacy Guard,” Juels said.

“The attacker VM is able to steal the victim VM’s full private (ElGamal) key. In other words, the attack results in complete compromise of one form of encryption in GnuPG.”

The success of the attack in gaining the keys rendered obsolete existing beliefs that virtualisation, through the use of distinct operating systems, provided effective isolation and therefore security.

It did this by targeting shared hardware resources, specifically the L1 instruction cache, which revealed enough information based on alternate process execution between the target and attacker to build a crypto key.

Importantly, the access-driven side-channel attacks overcame challenges including hypervisor noise, core migration, and the “difficulty of preempting the victim with sufficient frequency to extract fine-grained information”.

While the attacks required a target and attacker to be co-resident on a single machine, earlier research (pdf) had shown it is possible to locate clients within cloud infrastructure.

Copyright © SC Magazine, Australia

Co-lo VMs busted by crypto attack
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
Sign up to receive iTnews email bulletins
Latest Comments
In which area is your IT shop hiring the most staff?

   |   View results
IT security and risk
Sourcing and strategy
IT infrastructure (servers, storage, networking)
End user computing (desktops, mobiles, apps)
Software development

Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results