Dirty Disks Raise New Questions About Cloud Security

Research has identified potentially significant flaws in the implementation of Cloud infrastructure services offered by some providers, which could be putting their clients’ data at risk. By exploiting the vulnerability, which revolves around data separation, consultants were able to gain access to some data left on other service users’ ‘dirty disks’, including fragments of customer databases and elements of system information that could, in combination with other data, allow an attacker to take control of other hosted servers.

Four providers were tested and found that two of them, VPS.NET and Rackspace, were not always securely separating virtual servers or nodes through shared hard disk and network resources. Both providers were immediately informed of the findings. Rackspace worked closely with the researchers to identify and fix the potential vulnerability, which was found among some users of its now-legacy platform for Linux Cloud Servers.

Rackspace reports that it knows of no instance in which any customer’s data was seen or exploited in any way by any unauthorised party. Rackspace’s current cloud platform was tested as well as its new Next Generation Cloud computing solution based on OpenStack, to confirm that the security vulnerability has been resolved. But other providers might be vulnerable if they use popular hypervisor software, and implement it in the way that Rackspace did before its recent remediation efforts.

VPS.NET said it now allows customers to opt-in to having their data removed securely, leaving thousands of virtual machines at potential risk. OnApp added that it has not taken measures to clean up remnant data left by providers or customers, on the grounds that not many customers are affected.

During the course of the research, it became clear that if virtual machines are not sufficiently isolated or a mistake is made somewhere in the provisioning or de-provisioning process, then leakage of data might occur between servers.

In the cloud, instead of facing an infrastructure based on separate physical boxes, an attacker can purchase a node from the same provider and attempt an attack on the target organisation from the same physical machine and using the same physical resources. This does not mean that the Cloud is unsafe and the business benefits remain compelling, but the simplicity of this issue raises important questions about the maturity of Cloud technology and the level of security and testing undertaken in some instances.

The vulnerability itself is due to the way in which some providers automatically provision new virtual servers, initialise operating systems and allocate new storage space. For performance reasons or due to errors, security measures to provide separation between different nodes on a multi-user platform sometimes are not implemented, making it possible to read areas of other virtual disks and so gain access to data which exists on the physical storage provider.

While the data accessed by researchers was not live, the most recent data identified was less than a week old. This is most likely due to the virtual storage system moving disk images around the cloud to improve performance or disk usage, leaving old data in the original location which is subsequently reallocated but not zeroed to prevent the space being used.

Since being alerted to the issue last year, Rackspace has undertaken considerable efforts to ensure that any data deleted from their physical disk is zeroed to prevent new servers seeing other users and have taken measures to clean up all existing virtual disks, on what is now their legacy cloud servers platform.

It is unclear how widespread this issue is among other Cloud providers. By raising awareness of the problem, other service providers of Cloud Infrastructure services can ensure they do not put their customers data at risk in the same manner and customers can undertake the appropriate due diligence before moving to the Cloud.

Michael Jordon, Research and Development Manager at Context, has 11 years experience within the IT security and software development industry. Michael developed the Context App Tool (CAT) which is a web application security tool for performing manual application assessments. He has presented at various conferences including InfoSec, OWASP and RuxCon. He has also released advisories in software products including Sophos, Citrix and Outlook web access and released a whitepaper on 'Assessing Cloud Node Security'.