1. Ragib Hasan University of Alabama at Birmingham CS 491/691/791 Fall 2012 Lecture 4 09/10/2013 Security and Privacy in Cloud Computing

2. Mapping/topology Attacks 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Lecture Goal Learn about mapping attacks Discuss different techniques and mitigation strategies Analyze the practicality and impact Reading: Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds, Ristenpart et al., CCS 2009

3. Why Cloud Computing brings new threats? Traditional system security mostly means keeping bad guys out The attacker needs to either compromise the auth/access control system, or impersonate existing users 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

4. Why Cloud Computing brings new threats? But clouds allow co-tenancy : Multiple independent users share the same physical infrastructure So, an attacker can legitimately be in the same physical machine as the target 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

5. Challenges for the attacker How to find out where the target is located How to be co-located with the target in the same (physical) machine How to gather information about the target 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

6. Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds, Ristenpart et al., CCS 2009 First work on cloud cartography Attack launched against commercially available “real” cloud (Amazon EC2) Claims up to 40% success in co-residence with target VM 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

7. Strategy Map the cloud infrastructure to find where the target is located Use various heuristics to determine co- residency of two VMs Launch probe VMs trying to be co-resident with target VMs Exploit cross-VM leakage to gather info about target 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

8. Threat model Attacker model – Cloud infrastructure provider is trustworthy – Cloud insiders are trustworthy – Attacker is a malicious third party who can legitimately use the cloud as a client Assets – Confidentiality aware services run on cloud – Availability of services run on cloud 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

9. Tools of the trade Nmap, hping, wget for network probing Amazon EC2’s own DNS to map dns names to IPs 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

10. Sidenote: EC2 configuration EC2 uses Xen, with up to 8 instances per physical machine 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Dom0 is the first instance on the machine, connected to physical adapter All other instances route to external world via dom0 [Figures from Xen Wiki]

11. EC2 allocation scheme Users can choose – Region (US or Europe?) – Availability zone (i.e., data center) – Instance type (m1.small, c1.medium, m1.large, m1.xlarge, c1.xlarge) VMs share physical hardware; each VM gets 2 IP addresses : an external, and an internal IP 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

12. Task 1: Mapping the cloud Reverse engineering the VM placement schemes provides useful heuristics about EC2’s strategy 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Different availability zones use different IP regions. Each instance has one internal IP and one external IP. Both are static. For example: External IP: 75.101.210.100 External Name: ec2-75-101-210-100.computer-1.amazonaws.com Internal IP: 10.252.146.52 Internal Name: domU-12-31-38-00-8D-C6.computer-1.internal

13. Task 1: Mapping the cloud Clouds can be mapped via probing – External probing: The probe is outside the cloud – Internal probling: The probe is inside the cloud Internal probing has to satisfy Amazon’s policies, external probing doesn’t 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

14. Task 1: Mapping the Cloud 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Finding: same instance type within the same zone = similar IP regions Reverse engineered mapping decision heuristic: All IPs from /16 are from same availability zone A /24 inherits any included sampled instance type. A /24 containing a Dom0 IP address only contains Dom0 IP address. All /24’s between two consecutive Dom0 /24’s inherit the former’s associated type.

15. Task #2: Determining co-residence Co-residence: Check to determine if a given VM is placed in the same physical machine as another VM Network based check: – Match Dom0 IP addresses, check packet RTT, close IP addresses (within 7, since each machine has 8 VMs at most) – Traceroute provides Dom0 of target – No false positives found during experiments 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

16. Task #2: Determining co-residence How do we know the heuristics work? – Technique: Launch a disk based covert channel, such that only co-resident instances cane exchange data using it – E.g., one instance starts reading from random locations, causing longer disk read times for other co-located instances 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

17. Task #3: Making a probe VM co-resident with target VM Brute force scheme – Idea: figure out target’s availability zone and type – Launch many probe instances in the same area – Success rate: 8.4% 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

18. Task #3: Making a probe VM co-resident with target VM Smarter strategy: utilize locality – Idea: VM instances launched right after target are likely to be co-resident with the target – Paper claims 40% success rate 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

19. Task #3: Making a probe VM co-resident with target VM 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Window of opportunity is quite large, measured in days

20. Task #4: Gather leaked information Now that the VM is co-resident with target, what can it do? – Gather information via side channels – Perform DoS 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

21. Task 4.1: Gathering information If VM’s are separated and secure, the best the attacker can do is to gather information – Measure latency of cache loads – Use that to determine Co-residence Traffic rates Keystroke timing 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

22. Mitigation strategies #1: Mapping Use a randomized scheme to allocate IP addresses Block some tools (nmap, traceroute) 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

23. Mitigation strategies #2: Co-residence checks Prevent traceroute (i.e., prevent identification of dom0) 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

24. Mitigation strategies #3: Co-location Not allow co-residence at all – Beneficial for cloud user – Not efficient for cloud provider 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

25. Mitigation strategies #4: Information leakage Prevent cache load attacks? 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

26. Discussion How is the problem different from other attacks? What’s so special about clouds? 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

27. Discussion Cons – Are the side channels *really* effective? 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013

28. 9/10/2013Ragib Hasan | UAB CIS | CS491/691/791 Fall 2013 Further Reading Amazon downplays report highlighting vulnerabilities in its cloud service Hypothetical example described in report much harder to pull off in reality, company says TechWorld, Oct 29, 2009. http://bit.ly/dvxEZphttp://bit.ly/dvxEZp