Detecting co-residency with active traffic analysis techniques

Abstract

Virtualization is the cornerstone of the developing third party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat -unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels.This paper presents co-resident watermarking, a traffic analysis attack that allows a malicious co-resident VM to inject a watermark signature into the network flow of a target instance. This watermark can be used to exfiltrate and broadcast co-residency data from the physical machine, compromising isolation without reliance on internal side channels. As a result, our approach is difficult to defend without costly underutilization of the physical machine. We evaluate co-resident watermarking under a large variety of conditions, system loads and hardware configurations, from a local lab environment to production cloud environments (Futuregrid and the University of Oregon's ACISS). We demonstrate the ability to initiate a covert channel of 4 bits per second, and we can confirm coresidency with a target VM instance in less than 10 seconds. We also show that passive load measurement of the target and subsequent behavior profiling is possible with this attack. Our investigation demonstrates the need for the careful design of hardware to be used in the cloud.

Moving in Next Door: Network Flooding as a Side Channel in Cloud Environments

“…Additionally, we assume that the cloud provider is unaffiliated with adversaries, so Flooder cannot directly request co-residency with Victim. However, researchers have demonstrated indirect achievement of co-residency with specific victims on commercial clouds [1,4,7]. Therefore, we presume here that co-residency is achievable and build from there.…”

“…Using UDP instead of TCP to flood Victim promises improvements due to UDP's statelessness, allowing increased control over packet timing and size. Additionally, having a malicious client connect directly to Victim, as done in [1], would help to control for environmental fluctuation in Flooder's client's throughput. To work around provider rate limits, a promising avenue of research includes micro-bursts, flooding for brief periods of time, as well as using multiple Flooders working together.…”

“…By contrast, previous work was conducted on local testbeds and furthermore required a malicious client to remain connected to Victim on the order of seconds to reliably measure throughput [1]. This limited potential targets to web or media servers that offered large downloads publicly.…”

Previously-Selected-Server-First based Scalable VM Placement Algorithm for Mitigating Side Channel Attacks in Cloud Computing

“…Bates et al [11] proposed a system where adversarial VMs introduce traffic congestion in host NICs, which is then detected by remote clients. Similarly, Zhang et al [6] designed HomeAlone, a system that detects VM placement by issuing side-channels in the L2 cache during periods of low traffic.…”

A Measurement Method of Threat for Co-Residency Detection Based On Cloud Model

“…There are mainly four kinds of method for co-residency detection. The first bases on the network information [3], analysis network parameters to determine whether virtual machines are co-resident or not; the second bases on I/O resource competition [8], analysis the mutation of throughput load; the third bases on Co-Residency Watermarking [9], analysis time interval distribution of received network packet which are watermarked or non-watermarked; the fourth is use of L2 Cache Home Alone [10], analysis of the use of Cache.…”