3 research outputs found
Measuring and Mitigating the Risk of IP Reuse on Public Clouds
Public clouds provide scalable and cost-efficient computing through resource
sharing. However, moving from traditional on-premises service management to
clouds introduces new challenges; failure to correctly provision, maintain, or
decommission elastic services can lead to functional failure and vulnerability
to attack. In this paper, we explore a broad class of attacks on clouds which
we refer to as cloud squatting. In a cloud squatting attack, an adversary
allocates resources in the cloud (e.g., IP addresses) and thereafter leverages
latent configuration to exploit prior tenants. To measure and categorize cloud
squatting we deployed a custom Internet telescope within the Amazon Web
Services us-east-1 region. Using this apparatus, we deployed over 3 million
servers receiving 1.5 million unique IP addresses (56% of the available pool)
over 101 days beginning in March of 2021. We identified 4 classes of cloud
services, 7 classes of third-party services, and DNS as sources of exploitable
latent configurations. We discovered that exploitable configurations were both
common and in many cases extremely dangerous; we received over 5 million cloud
messages, many containing sensitive data such as financial transactions, GPS
location, and PII. Within the 7 classes of third-party services, we identified
dozens of exploitable software systems spanning hundreds of servers (e.g.,
databases, caches, mobile applications, and web services). Lastly, we
identified 5446 exploitable domains spanning 231 eTLDs-including 105 in the top
10,000 and 23 in the top 1000 popular domains. Through tenant disclosures we
have identified several root causes, including (a) a lack of organizational
controls, (b) poor service hygiene, and (c) failure to follow best practices.
We conclude with a discussion of the space of possible mitigations and describe
the mitigations to be deployed by Amazon in response to this study
EIPSIM: Modeling Secure IP Address Allocation at Cloud Scale
Public clouds provide impressive capability through resource sharing.
However, recent works have shown that the reuse of IP addresses can allow
adversaries to exploit the latent configurations left by previous tenants. In
this work, we perform a comprehensive analysis of the effect of cloud IP
address allocation on exploitation of latent configuration. We first develop a
statistical model of cloud tenant behavior and latent configuration based on
literature and deployed systems. Through these, we analyze IP allocation
policies under existing and novel threat models. Our resulting framework,
EIPSim, simulates our models in representative public cloud scenarios,
evaluating adversarial objectives against pool policies. In response to our
stronger proposed threat model, we also propose IP scan segmentation, an IP
allocation policy that protects the IP pool against adversarial scanning even
when an adversary is not limited by number of cloud tenants. Our evaluation
shows that IP scan segmentation reduces latent configuration exploitability by
97.1% compared to policies proposed in literature and 99.8% compared to those
currently deployed by cloud providers. Finally, we evaluate our statistical
assumptions by analyzing real allocation and configuration data, showing that
results generalize to deployed cloud workloads. In this way, we show that
principled analysis of cloud IP address allocation can lead to substantial
security gains for tenants and their users
Securing Cloud File Systems using Shielded Execution
Cloud file systems offer organizations a scalable and reliable file storage
solution. However, cloud file systems have become prime targets for
adversaries, and traditional designs are not equipped to protect organizations
against the myriad of attacks that may be initiated by a malicious cloud
provider, co-tenant, or end-client. Recently proposed designs leveraging
cryptographic techniques and trusted execution environments (TEEs) still force
organizations to make undesirable trade-offs, consequently leading to either
security, functional, or performance limitations. In this paper, we introduce
TFS, a cloud file system that leverages the security capabilities provided by
TEEs to bootstrap new security protocols that meet real-world security,
functional, and performance requirements. Through extensive security and
performance analyses, we show that TFS can ensure stronger security guarantees
while still providing practical utility and performance w.r.t. state-of-the-art
systems; compared to the widely-used NFS, TFS achieves up to 2.1X speedups
across micro-benchmarks and incurs <1X overhead for most macro-benchmark
workloads. TFS demonstrates that organizations need not sacrifice file system
security to embrace the functional and performance advantages of outsourcing