3 ms·
I'm gonna get put on a list for typing this out but I'll clarify: 1. Bad guy creates cloud account and spawns 10 of the cheapest VMs across different data cent
by dwrodri 3y ago
I'm gonna get put on a list for typing this out but I'll clarify:
1. Bad guy creates cloud account and spawns 10 of the cheapest VMs across different data centers, let's say this costs a total of, what... $50 a month?
2. Bad guy reads this paper, and makes a program that frequently samples SIMD registers. Contents get dumped to stdout and then streamed over an encrypted line to a RAID array hosted in $COUNTRY_WITHOUT_US_EXTRADITION.
3. Bad guy writes program to sift through data dumps on RAID array for passwords, encryption keys, etc.
If you create a cloud instance right now that has an SSH login on port 22, you stream the SSH login logs and see a steady stream of attempted logins to your device. While the marginal cost of brute forcing SSH logins is free (no cloud VM needed) and my proposed scenario isn't, I think this is a very real scenario that needs monitoring.
- DarkNova6 3y agohmmm. Does this not assume that a cpu is shared among exactly 2 tenants over a long period of time? And can‘t the cloud provider simply block access to the cpu api? Like they don’t allow you to create your own threads? Just trying to understand this.
- johncolanduoni 3y agoA VM cloud provider can't block you from running at least one thread, which is all the malicious threads required for this attack. However none of the big cloud providers share CPU cores between users to combat exactly this kind of thing. I really wish the people that did these disclosures were more up-front about this, instead of saying vague things like "frequently happens on modern-day computers". Though I guess you can assume that if an attack would work on AWS the researcher would definitely mention it, so the lack of such an explicit claim almost ensures the attack is not viable on major clouds.