A Cross-Virtual Machine Network Channel Attack via Mirroring and TAP Impersonation

Atif Saeed, Peter Garraghan, Barnaby Craggs, Dirk van der Linden, Awais Rashid, Syed Asad Hussain

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

7 Citations (Scopus)

Abstract

Data privacy and security is a leading concern for providers and customers of cloud computing, where Virtual Machines (VMs) can co-reside within the same underlying physical machine. Side channel attacks within multi-tenant virtualized cloud environments are an established problem, where attackers are able to monitor and exfiltrate data from co-resident VMs. Virtualization services have attempted to mitigate such attacks by preventing VM-to-VM interference on shared hardware by providing logical resource isolation between co-located VMs via an internal virtual network. However, such approaches are also insecure, with attackers capable of performing network channel attacks which bypass mitigation strategies using vectors such as ARP Spoofing, TCP/IP steganography, and DNS poisoning. In this paper we identify a new vulnerability within the internal cloud virtual network, showing that through a combination of TAP impersonation and mirroring, a malicious VM can successfully redirect and monitor network traffic of VMs co-located within the same physical machine. We demonstrate the feasibility of this attack in a prominent cloud platform - OpenStack - under various security requirements and system conditions, and propose countermeasures for mitigation.

Original languageEnglish
Title of host publication2018 IEEE International Conference on Cloud Computing, CLOUD 2018 - Part of the 2018 IEEE World Congress on Services
Place of PublicationPiscataway, NJ
PublisherIEEE
Pages606-613
Number of pages8
ISBN (Electronic)9781538672358
DOIs
Publication statusPublished - 2 Jul 2018
Externally publishedYes
Event11th IEEE International Conference on Cloud Computing, CLOUD 2018 - San Francisco, United States
Duration: 2 Jul 20187 Jul 2018

Publication series

NameIEEE International Conference on Cloud Computing, CLOUD
Volume2018-July
ISSN (Print)2159-6182
ISSN (Electronic)2159-6190

Conference

Conference11th IEEE International Conference on Cloud Computing, CLOUD 2018
Country/TerritoryUnited States
CitySan Francisco
Period2/07/187/07/18

Keywords

  • Cloud Computing
  • Network Channel Attack
  • OpenStack
  • Security

Fingerprint

Dive into the research topics of 'A Cross-Virtual Machine Network Channel Attack via Mirroring and TAP Impersonation'. Together they form a unique fingerprint.

Cite this