Amazon downplays reports of vulnerabilities in its EC2 cloud service

Hypothetical security issue described in a recent report is much harder to pull off in reality, Amazon says

Amazon says it has taken steps to mitigate a security issue in its cloud computing infrastructure that was identified recently by researchers from MIT and the University of California at San Diego.

The report described how attackers could search for, locate, and attack specific targets in Amazon's Elastic Computer Cloud (EC2) because of certain underlying vulnerabilities in the infrastructure.

[ Some say cloud security fears are overblown, but Cisco's CEO calls cloud computing a 'security nightmare.' | Keep up with all the latest cloud news with David Linthicum's Cloud Computing blog.]

Though the attack described in the report was conducted against Amazons infrastructure, the researchers concluded that similar targeted attacks could be carried out in other cloud services as well because the vulnerabilities were generic.

In response, Amazon spokeswoman Kay Kinton said Wednesday that the report describes cloud cartography methods that could increase at attacker's probability of launching a rogue virtual machine (VM) on the same physical server as another specific target VM.

What remains unclear, however, is how exactly attackers would be able to use that presence on the same physical server to then attack the target VM, Kinton told Computerworld via e-mail.

The research paper itself described how potential attackers could use so-called "side-channel" attacks to try and try and steal information from a target VM. The researchers had argued that a VM sitting on the same physical server as a target VM, could monitor shared resources on the server to make highly educated inferences about the target VM.

By monitoring CPU and memory cache utilization on the shared server, an attacker could determine periods of high-activity on the target servers, estimate high-traffic rates and even launch keystroke timing attacks to gather passwords and other data from the target server, the researchers had noted.

Such side-channel attacks have proved highly successful in non-cloud contexts, so there's no reason why they shouldn't work in a cloud environment, the researchers postulated.

However, Kinton characterized the attack described in the report as "hypothetical," and one that would be "significantly more difficult in practice."

"The side channel techniques presented are based on testing results from a carefully controlled lab environment with configurations that do not match the actual Amazon EC2 environment," Kinton said.

"As the researchers point out, there are a number of factors that would make such an attack significantly more difficult in practice," she said.

At the same time, Amazon takes all reports of vulnerabilities in its cloud infrastructure very seriously, she said. The company will continue to investigate potential exploits thoroughly and continue to develop features bolster security for users of its cloud service, she said.

Amazon Web Services has already rolled out safeguards that prevent potential attackers from using the cartography techniques described in the paper, Kinton said without offering any details.

She also pointed to the recently launched Amazon Web Service Multi-Factor Authentication (AWS MFA) as another example of the company's continuing effort to bolster cloud security. AWS MFA is designed to provide an extra layer access control to a customer's Web services account, Kinton said.

The research report that highlighted the security issues in cloud computing infrastructures is scheduled to be presented at the ACM Conference on Computer and Communications Security next month.