Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is there not more concern about the physical security of Cloudflare?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 58 posts

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#41

Post by luckylion »

viraptor wrote: post #19
pestatije wrote: post #2

ultimately you trust the company and the jurisdiction in which they operate...if they give you the wrong answers then you should adjust your level of trust accordingly...thankfully there are other platforms and this is one concern that can certainly be better marketed

While this is mostly true, the "trust the jurisdiction" is hard to apply here. They operate their PoPs in over 120 countries, so it's close to "do you trust all countries?" - it's a completely different model than trusting an AWS region for example.

Isn't that the same with Lamda@edge, so AWS also operates lots of PoPs all over the world that run code for you (if you want to)?

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#42

Post by bri3d »

rollcat wrote: post #39
crote wrote: post #31

Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machines in such a way that 1) the server can only boot genuine firmware images, and 2) unencrypted data is only available inside the CPU itself. That is going to rule out most attacks which don't involve dragging the server into a high-end laboratory, is it not?

Tangential: how does memory encryption mesh with features like DMA (which I imagine would be key on high-throughput NICs)?

For DMA, DMA endpoint buffers will generally be unencrypted and live in the "host domain," outside of the secure enclave running trusted code. This has been used to construct exploits against AMD's Secure Virtualization (which relies on memory encryption), for example: https://www.usenix.org/system/files/sec19-li-mengyuan_0.pdf .

There are some emerging technologies like SEV-TIO and PCI-IDE which attempt to extend the trust chain down into PCIe devices, allowing trusted devices to form a relationship with trusted code in a secure execution environment: https://www.amd.com/content/dam/amd/en/documents/developer/s...

Anyway, the best protection here is to terminate protocol or application-level encryption (TLS or whatever sits on top of your protocol) inside of the secure environment, so that decryption only occurs through encrypted memory. It's slower, but this way an attacker sitting as a RAM snoop could only see encrypted network traffic hit the DMA buffers, which wouldn't help them much.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#43

Post by g-b-r »

arccy wrote: post #5

What's the threat model that ram interception is an issue? I think the upsell is entirely reasonable, you get charged more for weird compliance demands.

Physical access opens up many possibilities to access the data, definitely not only the cold boot attack you're probably thinking of

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#44

Post by tredre3 »

rollcat wrote: post #39
crote wrote: post #31

Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machines in such a way that 1) the server can only boot genuine firmware images, and 2) unencrypted data is only available inside the CPU itself. That is going to rule out most attacks which don't involve dragging the server into a high-end laboratory, is it not?

Tangential: how does memory encryption mesh with features like DMA (which I imagine would be key on high-throughput NICs)?

This answer covers it well: https://security.stackexchange.com/a/189978

Basically depending on the scenario, DMA region will either be unencrypted or transparently encrypted/decrypted.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#45

Post by g-b-r »

udev4096 wrote: post #17
candiddevmike wrote: post #13

Earlier quoted context omitted.

What's a threat model where RAM intercept wouldn't be an issue?

Isn't it difficult to actually analyze the RAM content for any sensitive data? There is so much noise in it

No it isn't?

I recovered data of mine from ram many times

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#46

Post by viraptor »

luckylion wrote: post #41
viraptor wrote: post #19

Earlier quoted context omitted.

While this is mostly true, the "trust the jurisdiction" is hard to apply here. They operate their PoPs in over 120 countries, so it's close to "do you trust all countries?" - it's a completely different model than trusting an AWS region for example.

Isn't that the same with Lamda@edge, so AWS also operates lots of PoPs all over the world that run code for you (if you want to)?

Yup, you're right with Lambda@edge, I forgot about that one.

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#47

Post by kentonv »

simonw wrote: post #4

It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…

I'm the tech lead of Cloudflare Workers. I'm not actually the best person to answer the core questions here, but a few notes:

Cloudflare's Data Localization Suite gives you some control over where things run: https://www.cloudflare.com/data-localization/

Durable Objects specifically support jurisdiction restrictions, to keep your data strictly inside EU (for GDPR) or FedRAMP-compliant locations. https://developers.cloudflare.com/durable-objects/reference/...

The current set of locations supporting Durable Objects is mostly a function of where we have the resources available to operate the distributed database which we use as the storage back-end for first-generation DOs. We recently announced a new storage backend for Durable Objects, which is based on SQLite and a lot of in-house tech instead of an off-the-shelf distributed database. This new backend gives us a lot more flexibility in terms of locating data. There's a lot of work to do, but I would expect that we'll have more than just EU and FedRAMP as jurisdictions eventually. https://blog.cloudflare.com/sqlite-in-durable-objects/

Not specific to Workers: China is special. Your site will not be served from China at all (and your Workers will never run there) unless you've explicitly signed up for China network access. (I think the Chinese government requires a special licence for it? But I'm not an expert on this.) https://www.cloudflare.com/application-services/products/chi...

I don't personally know the current situation in Russia, or how physical security is managed in general (it's not what I work on, personally). I've heard some talk of trying to get the team to write a blog post about it, which I too would be interested to read!

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#48

Post by valbaca »

lfmunoz4 wrote: post #3

never heard of a story where physical security at any cloud provider has been a problem. are you worried about governments, or employees, or someone breaking in?

you must not deal with compliance (and bless you for it)

Re: Ask HN: Why is there not more concern about the physical security of Cloudflare?

#50

Post by Avamander »

dtquad wrote: post #36
simonw wrote: post #4

It's interesting to explore https://where.durableobjects.live/ - a tool that maps where Cloudflare's worker scripts actually run. Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there. EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed loc…

Recently, many European countries have started using Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with end-to-end encryption in a zero-trust model. However, these countries are now increasingly using Cloudflare Workers without realizing that this creates total uncertainty about where their data and business logic might end up—including potentially adversarial…

> ... Cloudflare’s anti-DDoS protection for government services, which is fine since it can be done securely with end-to-end encryption in a zero-trust model.

Unless it's below L7/HTTP, the possibility of doing it securely is very questionable.

Up until very recently it was very trivial to conduct "domain fronting" of sorts but with colocations in hostile locations. So Chinese or Russian servers decrypting your TLS traffic no questions asked, and that was with their premium (DLS) offerings.

I suspect that if you're in a hostile country where CF announces their prefixes locally, it's still doable. Unfortunately that's a bit more difficult to test than it was before.

Post reply on HN