Dirty disks raise new questions about cloud security

Research by Context Information Security has identified potentially significant flaws in the implementation of cloud infrastructure services offered by some providers which could be putting their clients’ data at risk. By exploiting the vulnerability, which revolves around data separation, Context consultants were able to gain access to data left on other service users’ ‘dirty disks’, including fragments of customer databases and elements of system information that could, in combination with other data, allow an attacker to take control of other hosted servers.

Context tested four providers and found that two of them, VPS.NET and Rackspace, were not always securely separating virtual servers or nodes through shared hard disk and network resources. In line with Context’s responsible disclosure procedures, both providers were immediately informed of the findings.

Rackspace worked closely with Context to identify and fix the potential vulnerability, which was found among some users of its now legacy platform for Linux cloud servers. Rackspace reports that it knows of no instance in which any customer’s data was seen or exploited in any way by an unauthorised party. Context has tested Rackspace’s current cloud platform as well as its new next-generation cloud computing solution based on OpenStack and has been able to confirm that the security vulnerability has been resolved.

But other providers might be vulnerable if they use popular hypervisor software and implement it in the way that Rackspace did, before its recent remediation efforts.

VPS.NET told Context that it rolled out a patch to resolve the security issue, but provided no details. VPS.NET is based on OnApp technology that is also used by over 250 other cloud providers. OnApp told Context that it now allows customers to opt-in to having their data removed securely, leaving thousands of virtual machines at potential risk. OnApp added that it has not taken measures to clean up remnant data left by providers or customers, on the grounds that not many customers are affected.

During the course of Context’s research, it became clear that if virtual machines are not sufficiently isolated or a mistake is made somewhere in the provisioning or deprovisioning process, then leakage of data might occur between servers.

“In the cloud, instead of facing an infrastructure based on separate physical boxes, an attacker can purchase a node from the same provider and attempt an attack on the target organisation from the same physical machine and using the same physical resources,” said Michael Jordon, Research and Development Manager at Context.

“This does not mean that the cloud is unsafe and the business benefits remain compelling, but the simplicity of this issue raises important questions about the maturity of cloud technology and the level of security and testing undertaken in some instances,” he said.

The vulnerability itself is due to the way in which some providers automatically provision new virtual servers, initialise operating systems and allocate new storage space. For performance reasons, or due to errors, security measures to provide separation between different nodes on a multiuser platform sometimes are not implemented, making it possible to read areas of other virtual disks and so gain access to data which exists on the physical storage provider.

While the data accessed by Context was not live, the most recent data identified was less than a week old. This is most likely due to the virtual storage system moving disk images around the cloud to improve performance or disk usage, leaving old data in the original location, which is subsequently reallocated but not zeroed to prevent the space being used.

Since being alerted to the issue by Context last year, Rackspace has undertaken considerable efforts to ensure that any data deleted from its physical disk is zeroed to prevent new servers seeing other users and it has taken measures to clean up all existing virtual disks, on what is now its legacy cloud servers platform.

“It is unclear how widespread this issue is among other cloud providers,” said Context’s Michael Jordon. “By raising awareness of the problem, other service providers of cloud infrastructure services can ensure they do not put their customers’ data at risk in the same manner and customers can undertake the appropriate due diligence before moving to the cloud.”

Context has published more details on the dirty disks vulnerability in a blog at: http://www.contextis.com/research/blog/dirtydisks.

NB: In line with responsible disclosure procedures and confidentiality obligations, Context limited access to making a determination that the data was available. Context did not disclose, use, record, transmit or store any of the data it accessed.