Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New cloud attack takes full control of virtual machines with little effort

arstechnica.com

Post reply on HN
Print view View original

71–80 of 105 posts

Re: New cloud attack takes full control of virtual machines with little effort

#71

Post by tristor »

willvarfar wrote: post #61
makomk wrote: post #57

Earlier quoted context omitted.

Don't think I've seen any non-server-grade processors in even the cheapest bargain-basement VPS hosts. (Low-end dedicated is different.) Cramming as many VMs into a big server as possible seems to be too important to their cost structure for that.

We perhaps only disagree on what is "server-grade" vs what is sold for servers. Google, for example, are famous for making big data centres out of cheap commodity boxes, and I double Amazon are any different. I certainly know the rackspace blades I've played with didn't make my grade of either! :)

I can't make any claims to contrary about other providers, but I know at the very least that at one point not in too distant past the primary systems used for Rackspace Cloud hypervisors were Dell R720 rackmount servers. Maybe not the most amazing hardware, but considering how common they are you can hardly refuse to say they're "server-grade". The newer OpenCompute stuff is also clearly well-made hardware.

Re: New cloud attack takes full control of virtual machines with little effort

#72

Post by tmaly »

It seems like a dedicated server would solve this issue in some sense. If your not on a shared VM, then an attacker could not affect the memory.

For those that cannot be on a dedicated server, what changes could be made to the shared VM memory setup to reduce this attack surface?

Re: New cloud attack takes full control of virtual machines with little effort

#73

Post by pjmlp »

userbinator wrote: post #67
niftich wrote: post #22

Earlier quoted context omitted.

> The rowhammer "attack" is successful only because the hardware is just plain broken I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead. This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from fr…

I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead. I extensively test all the hardware I buy (CPU: LINPACK, RAM: MemTest86+) and if it fails any of those tests, it gets returned as "not fit for purpose". I've done this successfully a few times. A lot of other…

How do you do it, regarding LINPACK?

I assume just compiling it and execute some tests that are part of it?

Re: New cloud attack takes full control of virtual machines with little effort

#74

Post by saltyhiker »

Wakko1 wrote: post #39
SBArbeit wrote: post #8

Earlier quoted context omitted.

What about Hyper-V / Microsoft Azure? Anyone know if they de-dup memory like this?

No. Hyper-V has no memory De-dup function. Azure runs on Hyper-V so it's not vulnerable either.

What popular cloud providers are vulnerable?

Re: New cloud attack takes full control of virtual machines with little effort

#75

Post by jameshart »

caf wrote: post #5

I wonder if it would be worth checksumming public keys and re-checking the checksum each time it's used?

If your threat model now includes 'the attacker can at arbitrary times make arbitrary alterations to the working memory of my process' then no, this won't help. You can't trust the checksum, you can't trust that the data you just check summed hasn't subsequently changed, and you can't trust that data which passes a checksum wasn't previously different. Also you can't trust the checksum code itself. Or the operating system you're running on. Or anything.

Re: New cloud attack takes full control of virtual machines with little effort

#76

Post by shshhdhs »

willvarfar wrote: post #62
andrewstuart2 wrote: post #9

It seems the HN title and original title are both pretty wrong, at least according to the article content. The attack vector is really the ability to, if you have a known public key and a server using it, perform a pre-calculated bit flip such that the new public key is much easier to factor, and thus obtain a corresponding private key. So you're not obtaining original private keys, you're altering original public ke…

Another attack would be to flip bits in code pages... That the attackers illustrated it by changing public keys so they could push updates or ssh into a box doesn't mean that's all the ways they could have compromised. You can't say "I don't use SSH so I'm safe!" or anything like that.

I don't understand....

Re: New cloud attack takes full control of virtual machines with little effort

#77

Post by acobster »

lifeisstillgood wrote: post #55

some thoughts: For the attacks to work, the cloud hosting the VMs must have deduplication enabled so that physical pages are shared between customers. This seemingly is an attack where two VMs on the same host can read each other's memory, if a deduplication flag is set on the VM controller. This seems to offer cloud holsters some easy (paid for) upgrades to be honest its not (afaik) heartbleed time. It's bad but the…

The abstract says the attack allows "flips over arbitrary physical memory in a fully controlled way." If I'm understanding that correctly, it would be trivial to then restore the old key alongside it, leaving the victim none the wiser.

Also, as others have pointed out, this is a hardware issue and the clear solution is to swap out the vulnerable RAM. Yeah, paying more is an "easy" way to have peace of mind (if that's even an option for you as a "cloud hoster"), but that's just backwards IMHO: a security vulnerability on the host's side should not translate into an upsell.

Re: New cloud attack takes full control of virtual machines with little effort

#78

Post by GTP »

wepple wrote: post #66
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

without being an expert in this area; my gut feel is that the fix to this problem is likely going to be funded by the end user. Given that competition continues to drive prices down, would 'secure ram' be viable? would you pay more for it?

I have the same opinion as you. I would but most people wouldn't. The root cause of the problem is since the trend about ram is "the bigger the better" (in terms of GBs) we have tons of capacitors on a small surface. I'm no expert too but I think there's no simple hardware fix for this instead of returning back to RAMs that hold less memory, but most people won't accept it. Maybe we're hitting the limits of the current technology and we should switch to another one. Just on a side note two years ago one of my professors quoted an ongoing research in my university about RAM that instead of storing electrons formed crystals, but I don't know any other detail about this.

Re: New cloud attack takes full control of virtual machines with little effort

#79

Post by acobster »

Dylan16807 wrote: post #60
jerf wrote: post #27

Earlier quoted context omitted.

Hostile environments attack your software without intelligence. (When working with them, it may seem otherwise, but that's just cynicism.) Hostile people attack intelligently. Whatever mitigation you may imagine is possible by checking CRCs or something after the fact, you must account for the possibility that the software, the OS, or the CRC has also been attacked by a hostile intelligent adversary. The fact that we…

Rowhammer is largely random. You don't get to target specific bits of physical ram. You find scarce weak bits and work to get the data located there. In this case that means you can only pick a couple bits per 4KB to attack. That won't let you fake out a CRC.

That's where I'm getting a little hazy. The paper says the attacker can "induce bit flips over arbitrary physical memory in a fully controlled way." Sounds a little more advanced than "largely random" to me, and based on the article it sounds like FFS is a step up from "vanilla" Rowhammer...am I missing something?

Re: New cloud attack takes full control of virtual machines with little effort

#80

Post by progval »

shshhdhs wrote: post #76
willvarfar wrote: post #62

Earlier quoted context omitted.

Another attack would be to flip bits in code pages... That the attackers illustrated it by changing public keys so they could push updates or ssh into a box doesn't mean that's all the ways they could have compromised. You can't say "I don't use SSH so I'm safe!" or anything like that.

I don't understand....

The code of running processes is loaded into memory. Flipping bits in the memory can potentially modify the code.
Post reply on HN