A Cross-Virtual Machine Network Channel Attack via Mirroring and TAP Impersonation

Saeed, Atif and Garraghan, Peter and Craggs, Barnaby and van der Linden, Dirk and Rashid, Awais and Asad Hussain, Syed (2018) A Cross-Virtual Machine Network Channel Attack via Mirroring and TAP Impersonation. In: 2018 IEEE International Conference on Cloud Computing (CLOUD). IEEE, pp. 606-613. ISBN 9781538672358

[img]
Preview
PDF (Cloud Cross-VM Attack)
Cloud_Cross_VM_Attack.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (7MB)

Abstract

Data privacy and security is a leading concern for providers and customers of cloud computing, where Virtual Machines (VMs) can co-reside within the same underlying physical machine. Side channel attacks within multi-tenant virtualized cloud environments are an established problem, where attackers are able to monitor and exfiltrate data from co-resident VMs. Virtualization services have attempted to mitigate such attacks by preventing VM-to-VM interference on shared hardware by providing logical resource isolation between co-located VMs via an internal virtual network. However, such approaches are also insecure, with attackers capable of performing network channel attacks which bypass mitigation strategies using vectors such as ARP Spoofing, TCP/IP steganography, and DNS poisoning. In this paper we identify a new vulnerability within the internal cloud virtual network, showing that through a combination of TAP impersonation and mirroring, a malicious VM can successfully redirect and monitor network traffic of VMs co-located within the same physical machine. We demonstrate the feasibility of this attack in a prominent cloud platform – OpenStack – under various security requirements and system conditions, and propose countermeasures for mitigation.

Item Type:
Contribution in Book/Report/Proceedings
Additional Information:
©2018 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
Subjects:
ID Code:
125429
Deposited By:
Deposited On:
23 May 2018 13:18
Refereed?:
Yes
Published?:
Published
Last Modified:
30 Sep 2020 04:13