3 ms·
This means that Customer A's VM cannot attack Customer B's VM. However, if the OS inside the VM is unpatched, then code inside the VM can attack other code ins
by thesandlord 9y ago
This means that Customer A's VM cannot attack Customer B's VM.
However, if the OS inside the VM is unpatched, then code inside the VM can attack other code inside the VM. If for example you install some malware on your VM, it could use this attack.
(I am not a security expert, this is just my understanding and not a official Google statement)
- oh-kumudo 9y agoRight. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?
- rurban 9y agoNot against Spectre, which can extract any memory via javascript or user applications. Eg your secret keys or passwords
- oh-kumudo 9y agoSpectre is a much more serious bug I feel, but it requires the VM to run the malicious code snippet inside itself and with the right context, not from other guest VM, that is how I understand this. The kinda bug that would totally destroy cloud as a business is the one that other guest VM can read your memory...which doesn't seem like to be the case, for now...
- rurban 9y agoSpectre is mostly about JavaScript extracting keys and passwords from the browser process. Install their ChromeZero extension for a start. Meltdown on the other hand can do everything. But only on Intel.