5 ms·

Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without h

Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers. Even a lot of VM/cloud systems have some kind of virtual management console (Linode has their LISH system that lets you SSH in to console and Vultr/Digital Ocean have similar web based consoles .. AWS surprisingly doesn't. You can get console output but can't send VMs any console input). Not only should have NordVPN been aware of this hardware KVM, they should have secured it and had version checks on its firmware as an essential part of their security. I could see this oversight with other companies, but not with one whose primary business claims to be security.

notyourday 7y ago
> Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers. Power on/off should be done via APIs that issue commands to a PDU, like Atlantic.net started doing in the early 200s. And there's nearly zero reason to access "console" - configure your server to always but off PXE and fall through to disk if that intercept is not needed.
jessaustin 7y ago
.. AWS surprisingly doesn't. Why is this surprising? AWS seem to know what they're doing in general, and this is obviously the right policy in this particular area.
- comex 7y ago
  How is it “obviously” the right policy? If implemented, console input would presumably be part of the AWS API, guarded with IAM permissions like everything else. If you have full IAM permissions, you can already take over any instance by temporarily attaching its disk to a different instance and modifying the data from there. (That requires rebooting, but so would takeover via console input.) Indeed, I’ve had to do exactly that on multiple occasions to fix broken config files on my personal instance; it would have been much more convenient to have console input.
  - jessaustin 7y ago
    This "personal instance" model doesn't really fit AWS: if the instance is borked then fail over to another one that isn't. No need for console input.
- toast0 7y ago
  FreeBSD has an interactive kernel debugger that you can use with a serial console. Super useful to track down some things, not usable on AWS -- you'd need to (somehow) do a core dump and hope you can figure it out from there.
- CodesInChaos 7y ago
  Amazon has security critical functionality on an unauthenticated http endpoint on a link local address. That's pretty damn dumb in my book.
  - defined 7y ago
    Support for your assertion: https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilities-perspective/ https://rhinosecuritylabs.com/cloud-security/aws-security-vu...
    - jessaustin 7y ago
      That's a great link, but they're looking at "misconfigurations". How is that relevant here?
      - defined 7y ago
        > Since the metadata service doesn’t require any particular parameters, fetching the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/IAM_USER_ROLE_HERE http://169.254.169.254/latest/meta-data/iam/security-credent... will return the AccessKeyID, SecretAccessKey, and Token you need to authenticate into the account. They talk about the AWS “Metadata Service” Attack Surface and how juicy a target it is. I was just providing support for that opinion.
  - jessaustin 7y ago
    Yes, software that runs on the instance can learn instance metadata. No, that is not a problem. Running e.g. user-supplied scripts on the instance would be "pretty damn dumb", but no one is that dumb. Any widely distributed software that did something shady with instance metadata would get busted PDQ. Just like any widely distributed software that did something shady with e.g. root credentials, which is about the same threat scenario.
    - CodesInChaos 7y ago
      It's crappy design which bypasses important security mechanisms of the OS (lower privileged users) by allowing every application with network access to access such critical functionality. One sane approach would be passing this information to the OS through the hypervisor which then exposes it as a properly ACLed file system. This is like an author of a website vulnerable to CSRF (because it relies on IP for auth) blaming browsers for allowing cross site requests instead of require proper authentication. Except that Amazon is powerful enough to get away with pushing all the effort onto developers and admins.
deleted 7y ago
[deleted]

notyourday 7y ago

> Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers. Power on/off should be done via APIs that issue commands to a PDU, like Atlantic.net started doing in the early 200s. And there's nearly zero reason to access "console" - configure your server to always but off PXE and fall through to disk if that intercept is not needed.

jessaustin 7y ago

.. AWS surprisingly doesn't. Why is this surprising? AWS seem to know what they're doing in general, and this is obviously the right policy in this particular area.

comex 7y ago
How is it “obviously” the right policy? If implemented, console input would presumably be part of the AWS API, guarded with IAM permissions like everything else. If you have full IAM permissions, you can already take over any instance by temporarily attaching its disk to a different instance and modifying the data from there. (That requires rebooting, but so would takeover via console input.) Indeed, I’ve had to do exactly that on multiple occasions to fix broken config files on my personal instance; it would have been much more convenient to have console input.
- jessaustin 7y ago
  This "personal instance" model doesn't really fit AWS: if the instance is borked then fail over to another one that isn't. No need for console input.
toast0 7y ago
FreeBSD has an interactive kernel debugger that you can use with a serial console. Super useful to track down some things, not usable on AWS -- you'd need to (somehow) do a core dump and hope you can figure it out from there.
CodesInChaos 7y ago
Amazon has security critical functionality on an unauthenticated http endpoint on a link local address. That's pretty damn dumb in my book.
- defined 7y ago
  Support for your assertion: https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilities-perspective/ https://rhinosecuritylabs.com/cloud-security/aws-security-vu...
  - jessaustin 7y ago
    That's a great link, but they're looking at "misconfigurations". How is that relevant here?
    - defined 7y ago
      > Since the metadata service doesn’t require any particular parameters, fetching the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/IAM_USER_ROLE_HERE http://169.254.169.254/latest/meta-data/iam/security-credent... will return the AccessKeyID, SecretAccessKey, and Token you need to authenticate into the account. They talk about the AWS “Metadata Service” Attack Surface and how juicy a target it is. I was just providing support for that opinion.
- jessaustin 7y ago
  Yes, software that runs on the instance can learn instance metadata. No, that is not a problem. Running e.g. user-supplied scripts on the instance would be "pretty damn dumb", but no one is that dumb. Any widely distributed software that did something shady with instance metadata would get busted PDQ. Just like any widely distributed software that did something shady with e.g. root credentials, which is about the same threat scenario.
  - CodesInChaos 7y ago
    It's crappy design which bypasses important security mechanisms of the OS (lower privileged users) by allowing every application with network access to access such critical functionality. One sane approach would be passing this information to the OS through the hypervisor which then exposes it as a properly ACLed file system. This is like an author of a website vulnerable to CSRF (because it relies on IP for auth) blaming browsers for allowing cross site requests instead of require proper authentication. Except that Amazon is powerful enough to get away with pushing all the effort onto developers and admins.

deleted 7y ago

[deleted]