5 ms·

One totally practical use case for this is to ensure that none of the virtual machines that you have allocated on your cloud provider are on the same physical h

One totally practical use case for this is to ensure that none of the virtual machines that you have allocated on your cloud provider are on the same physical hardware. This would be extremely useful for reliability purposes. I wonder how hard it would be to build something like that on top of this library?

redrabbyte 10y ago
not that hard, but keep in mind the current limitations on supported cpus
zbjornson 10y ago
Interesting idea. Don't think that would work for multi-socket boards though, which I think are most servers.
- spullara 10y ago
  Ah, didn't see the restriction to single socket boards but that makes sense. Probably not going to work for any of the major cloud providers then.
  - inetknght 10y ago
    It could work intermittently depending on which vCPUs your VM or covert channel apps get assigned (intermittently as that could change unless your hypervisor uses CPU pinning...)
westbywest 10y ago
Given that it's not economical for cloud providers to let too many of their customers monkey with resource provisioning, I gather such efforts on the part of the customer can only be so effective.
j_s 10y ago
With virtual machines I control, I don't have to use covert channels? https://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf https://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf (2009) Edit: we describe an empirical mea-surement study focused on understanding VM placement in the EC2 system and achieving co-resident placement for an adversary. To do this, we make use of network probing both to identify public services hosted on EC2 and to provide evidence of co-residence (that two instances share the same physical server). In particular, we utilize nmap, hping, and wget to perform network probes to determine liveness of EC2 instances The hard disk contention channel was used in Section 6 for establishing co-residence of instances.
- Florin_Andrei 10y ago
  That assumes the provider will disclose hardware info to you, which is rarely the case.
  - j_s 10y ago
    (I apologize in advance if I've missed recognition of your authority on this topic; as an outsider it appears you are wrong.) Are you speaking generally or specifically addressing a shortcoming of the linked paper which demonstrates a methodology to determine whether or not two AWS VMs are on the same physical host? After a brief review I still don't see any mention of "hardware info" you mention as assumed being available. Edit: If something has come up since 2009 with this specific paper, I'd appreciate the heads-up!
angerbot 10y ago
I don't know that it would be difficult to reproduce the test that is mentioned in the paper linked below, but they do mention the following anyways for EC2: > A single account was never seen to have two instances simultaneously running on the same physical machine, so running n instances in parallel under a single account results in placement on n separate machines

redrabbyte 10y ago

not that hard, but keep in mind the current limitations on supported cpus

zbjornson 10y ago

Interesting idea. Don't think that would work for multi-socket boards though, which I think are most servers.

spullara 10y ago
Ah, didn't see the restriction to single socket boards but that makes sense. Probably not going to work for any of the major cloud providers then.
- inetknght 10y ago
  It could work intermittently depending on which vCPUs your VM or covert channel apps get assigned (intermittently as that could change unless your hypervisor uses CPU pinning...)

westbywest 10y ago

Given that it's not economical for cloud providers to let too many of their customers monkey with resource provisioning, I gather such efforts on the part of the customer can only be so effective.

j_s 10y ago

With virtual machines I control, I don't have to use covert channels? https://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf https://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf (2009) Edit: we describe an empirical mea-surement study focused on understanding VM placement in the EC2 system and achieving co-resident placement for an adversary. To do this, we make use of network probing both to identify public services hosted on EC2 and to provide evidence of co-residence (that two instances share the same physical server). In particular, we utilize nmap, hping, and wget to perform network probes to determine liveness of EC2 instances The hard disk contention channel was used in Section 6 for establishing co-residence of instances.

Florin_Andrei 10y ago
That assumes the provider will disclose hardware info to you, which is rarely the case.
- j_s 10y ago
  (I apologize in advance if I've missed recognition of your authority on this topic; as an outsider it appears you are wrong.) Are you speaking generally or specifically addressing a shortcoming of the linked paper which demonstrates a methodology to determine whether or not two AWS VMs are on the same physical host? After a brief review I still don't see any mention of "hardware info" you mention as assumed being available. Edit: If something has come up since 2009 with this specific paper, I'd appreciate the heads-up!

angerbot 10y ago

I don't know that it would be difficult to reproduce the test that is mentioned in the paper linked below, but they do mention the following anyways for EC2: > A single account was never seen to have two instances simultaneously running on the same physical machine, so running n instances in parallel under a single account results in placement on n separate machines