Malware in the Cloud: What You Need to Know

Image

Cloud security is not as simple as it may seem. Businesses have a shared security responsibility with cloud service providers, but some lack the knowledge to keep up their share of the bargain. Poor configuration and data leaks are common problems that many businesses encounter in the cloud. These issues can lead to malware infecting your cloud computing environment. Here are a few of the different types of malware that can disrupt your cloud services.

DDoS Attacks

Botnets are becoming more and more common, with malware-as-a-service being offered by more malicious actors at an increasingly cheap price. Self-service cloud offerings allow these attackers to easily gain access and notoriety by launching large-scale DDoS attacks, which have been measured at speeds of up to 30 Gbps. Since cloud computing hosts multiple customers in a single cloud, these attacks can affect your cloud environment, as well.

Hypercall Attacks

An attacker uses a Virtual Machine (VM) to intrude the victim’s VM by exploiting the Virtual Machine Manager (VMM) hypercall handler. This gives the attacker the ability to access VMM privileges and possibly even execute malicious code.

Hypervisor DoS

This attack uses a high percentage of your hypervisor’s resources in order to leverage flaws in design or setup. Researchers found that this malware accounted for 70 percent of malware attacks targeting cloud providers’ hypervisor, which manages customers’ virtual environments. One study found that 71.2 percent of all Xen and 65.8 percent of all KVM vulnerabilities could be exploited by a guest VM. For the sake of context, AWS uses Xen for its hypervisor, and Google uses a proprietary version of KVM.

Co-Location

An attacker tries to find the target VM’s host in order to place their own VM on the same host. This is used to gain leverage in cross-VM side-channel attacks, such as Flush/Reload or Prime and Probe.

Hyperjacking

This is where an attacker tries to take control of the hypervisor, sometimes using a virtual machine-based rootkit. If the attacker is successful, they will have access to the entire machine. This could be used to change the behavior of the VM, causing it to be partially or fully compromised.

Man in the middle (MITM)

MITM is when an attacker can intercept and/or change messages exchanged between users. Ghostwriter is a common precursor to a MitM attack. This allows the attacker access to a misconfigured cloud configuration with public write access.

Exploiting Live Migration

During migration from one cloud service provider to another, the cloud management system is tricked into creating multiple migrations, which turns into a denial-of-service attack. This can also be used to potentially craft a VM Escape.

VM Escape

This accounts for 13.1 percent of all malware attacks on virtual machines in cloud environments. VM Escape involves running in a VM and escaping to infect the hypervisor. The goal in this attack is to obtain root privileges, host OS control and maybe even full access across the environment.

Flush/Reload

This attack utilizes a memory optimization technique known as memory deduplication. By enacting a sophisticated cross side-channel technique, a malicious actor can detect a full AES encryption key.

Prime and Probe

This is a VM cross side-channel attack that utilizes cache instead of memory. The attacker fills the cache with some of their own information. Once the victim uses the VM, the attacker uses this information to see which cache lines were accessed by the victim. This method has been used to recover an AWS encryption key. Tripwire offers services for AWS and Microsoft Azure to protect your assets in the cloud. Download our Cloud Management Assessor Datasheet to ensure the secure configuration of your AWS and Azure accounts.  

Image

About the Author: Katrina Roberts is a technical writer and illustrator. She enjoys cheesy puns, jasmine bubble tea, watching horror movies and crafting illustrations. You can find her on Twitter @punslikepizza and at PunsLikePizza.com  Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.