7 Dumb Cloud Computing Myths

• E-mail
• Share

Users of virtual machines (VMs) -- standard features of the multi-tenant clouds -- fervently hope that one virtual machine can't spy on another running on the same server. But extremely skillful manipulators have been able to draw conclusions about what's going on in a neighboring VM by watching what cache pages get emptied out of host memory after the spying VM has taken its turn using the server core. Since the spy just loaded the cache pages, it knows which data has been selected to be emptied out by the next user. And that, it turns out, is an indicator of what's currently executing on the processor. Ars Technica ran a piece on the phenomenon Nov. 6, noting it's extremely difficult to do, but scientists at the University of North Carolina, University of Wisconsin and RSA Laboratories demonstrated that it's possible to derive an encryption private key from this process. And there go the keys to the kingdom.

It's not clear to me how the spy VM knows which pages in the shared cache memory are being deleted if it's in its idle state, but the research shows that it does. It's still a painstaking effort to build a picture of the code executing, even when you have that information. You have to string together fragments of executing code over and over again until you get a piece of telling code. But that's what the researchers did.

So far, no one has been able to do this maliciously in a real-world setting -- or if they have, it's not publicly known. And there are fixes to prevent it. Nevertheless, it's a blow to confidence in what heretofore appeared to be the virtual server's impenetrable, logical barriers.

And the researchers' paper went a step further than simply suggesting cache page downloads were the only point of exposure. They also indicated that one virtual machine may be able to sense "the magnetic emanations" signifying types of activity by another. Again, there's no evidence anyone has made use of these findings in a malicious way, and major data centers may come up with countermeasures before they do. But no one is quite sure when this information, in the wrong hands, will be used to breach existing defenses.

Image Credit: Flickr user kellinahandbasket

RECOMMENDED READING:

Answers To 9 Questions About Public Cloud Migration

Cloud Myth 101: Cloud Is A Place

Oracle Open World: Key Questions On Cloud Vision

Cloud's Big Caveat: Runaway Costs

Cloud's Thorniest Question: Does It Pay Off?

Terremark Cloud Services Pass DOD Security Test

Will Dell Lead The x86 Data Center Market?

N.Y. Times Data Center Indictment Misses Big Picture

How The Feds Drive Cloud Innovation