Prying CoW: Inferring Secrets Across Virtual Machine Boundaries

Gerald Palfinger, Bernd Prünster, Dominik Ziegler

Publikation: Beitrag in Buch/Bericht/KonferenzbandBeitrag in einem Konferenzband

Abstract

By exploiting a side channel created by Copy-on-Write (CoW) operations of modern file systems, we present a novel attack which allows for detecting files in a shared cloud environment across virtual machine boundaries. In particular, we measure deduplication operation timings in order to probe for existing files of neighbouring virtual machines in a shared file system pool. As a result, no assumptions about the underlying hardware and no network access are necessary. To evaluate the real-world implications, we successfully demonstrate the feasibility of our attack on the ZFS file system. Our results clearly show that the presented attack enables the detection of vulnerable software or operating systems in a victim’s virtual machine on the same file system pool with high accuracy. Furthermore, we discuss several potential countermeasures and their implications.
Originalspracheenglisch
TitelProceedings of the 16th International Joint Conference on e-Business and Telecommunications
ErscheinungsortPrague, Czech Republic
Herausgeber (Verlag)SciTePress - Science and Technology Publications
Seiten187 - 197
Band2: SECRYPT
ISBN (elektronisch)978-989-758-378-0
DOIs
PublikationsstatusVeröffentlicht - Jul 2019
Veranstaltung16th International Joint Conference on e-Business and Telecommunications - Prague, Tschechische Republik
Dauer: 26 Jul 201928 Jul 2019

Konferenz

Konferenz16th International Joint Conference on e-Business and Telecommunications
KurztitelICETE 2019
LandTschechische Republik
OrtPrague
Zeitraum26/07/1928/07/19

Fingerprint

Untersuchen Sie die Forschungsthemen von „Prying CoW: Inferring Secrets Across Virtual Machine Boundaries“. Zusammen bilden sie einen einzigartigen Fingerprint.

Dieses zitieren