3 ms·
> The infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. This also means that customer
by oh-kumudo 9y ago
> The infrastructure that runs Compute Engine and isolates customer workloads from each other is protected against known attacks. This also means that customer VMs are protected against known, infrastructure-based attacks from other malicious VMs.
Doesn't Google say that they are protected...?
- thesandlord 9y agoThis means that Customer A's VM cannot attack Customer B's VM. However, if the OS inside the VM is unpatched, then code inside the VM can attack other code inside the VM. If for example you install some malware on your VM, it could use this attack. (I am not a security expert, this is just my understanding and not a official Google statement)
- oh-kumudo 9y agoRight. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?
- rurban 9y agoNot against Spectre, which can extract any memory via javascript or user applications. Eg your secret keys or passwords
- oh-kumudo 9y agoSpectre is a much more serious bug I feel, but it requires the VM to run the malicious code snippet inside itself and with the right context, not from other guest VM, that is how I understand this. The kinda bug that would totally destroy cloud as a business is the one that other guest VM can read your memory...which doesn't seem like to be the case, for now...
- rurban 9y agoSpectre is mostly about JavaScript extracting keys and passwords from the browser process. Install their ChromeZero extension for a start. Meltdown on the other hand can do everything. But only on Intel.