Researchers use virtual machine for cloud crypto key attack
Computer scientists at the University of North Carolina have constructed (pdf) a system whereby a malicious virtual machine is used in a so-called access-driven side-channel attack for the first time.
Running on the Xen hypervisor, the attack succeeded in extracting an ElGamal decryption key from a victim virtual machine using the most recent version of the libgcrypt cryptographic library, the researchers wrote.
It undermines hitherto assumed strong isolation guarantees for VMs on public cloud systems such as Amazon EC2, Microsoft Azure and Rackspace, as well as military multi-level security environments and virtualised enterprise and home desktops. Traditional access control mechanisms in virtual machine managers that enforce logical isolations between virtual machines many not be sufficient if attackers can circumvent these in side-channel attacks, the researchers said.
