Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

Cloud computing: gaps in the “cloud” - Massive security flaws at Amazon Web Services discovered

24.10.2011
RUB researchers present hack at the ACM Cloud Computing Security Workshop in Chicago

Researchers from Ruhr-University Bochum have found a massive security gap at Amazon Cloud Services. Using different methods of attack (signature wrapping and cross site scripting) they tested the system which was deemed “safe”.

“Based on our research results, Amazon confirmed the security gaps and closed them immediately”, said Prof. Dr. Jörg Schwenk, chair for network and data security at the RUB. Amazon Web Services (AWS) offers its customers cloud computing services and hosts, among others, services like Twitter, Second Life and 4Square.

Cloud computing could be the major computing paradigm of tomorrow. The idea of processing and storing software and data in a cheap external infrastructure is becoming increasingly popular. The fact that these services are by no means as secure as promised is now demonstrated by the research results of Prof. Schwenk and his staff.

Concentrated computing power

The “Cloud” is a collection of many virtual servers with concentrated computing power. Outsourcing to cloud computing has many advantages for professional users: they can rent storage and server capacity short term on demand. The service is invoiced, for example, according to the usage period, and the customer saves the cost of purchasing his own software and hardware. Up to now, the discussion about cloud computing has above all been dominated by the inability to comply with legal requirements. “Real” attacks were, however, less in the public eye.

Search for weak points

“A major challenge for cloud providers is ensuring the absolute security of the data entrusted to them, which should only be accessible by the clients themselves,” said Prof. Schwenk, who set out with his staff to seek weak points. They have found what they were looking for: Juraj Somorovsky, Mario Heiderich and Meiko Jensen tested the security concept of the cloud provider Amazon Web Services.

XML signature wrapping attacks

“Using different kinds of XML signature wrapping attacks, we succeeded in completely taking over the administrative rights of cloud customers”, said Juraj Somorovsky. “This allowed us to create new instances in the victim’s cloud, add or delete images.” The researchers suspect that many cloud offers are susceptible to signature wrapping attacks, since the relevant web service standards make performance and security incompatible. “We are working on a high-performance solution, however, that no longer has any of the known security gaps”, said Prof. Dr. Jörg Schwenk.

Cross site scripting attacks

In addition, the researchers found gaps in the AWS interface and in the Amazon shop which were ideally suited for smuggling in executable script code - what are termed cross-site scripting attacks. With alarming consequences: “We had free access to all customer data, including authentication data, tokens, and even plain text passwords” said Mario Heiderich. The researcher see the common login as a complex potential danger: “It's a chain reaction. A security gap in the complex Amazon shop always also directly causes a gap in the Amazon cloud.”

Private Clouds also vulnerable

In contrast to public belief, Private Clouds are also vulnerable to the aforementioned attacks: Eucalyptus, an open source project widely used to implement Cloud solutions within companies, did expose the same weaknesses. “A rough classification of cloud technologies cannot replace a thorough security investigation”, states Prof. Schwenk.

Security gaps closed

“Critical services and infrastructures are making increasing use of cloud computing”, explained Juraj Somorovsky. According to industry estimates, the turnover of European cloud services is set to more than double in the next four years – from around 68 billion Euros in 2010 to about 148 billion in 2014. “Therefore it is essential that we recognise the security gaps in cloud computing and avoid them on a permanent basis.” Industry took immediate action: “On our advice, Amazon and Eucalyptus confirmed the security gaps and closed them immediately”.

Further information

Prof. Dr. Jörg Schwenk, Faculty of Electrical Engineering and Information Sciences at the RUB, Chair for Network and Data Security, Tel. +49 234 32 26692

joerg.schwenk@rub.de

Editor: Jens Wylkop

Dr. Josef König | idw
Further information:
http://www.ruhr-uni-bochum.de/

More articles from Information Technology:

nachricht PhoxTroT: Optical Interconnect Technologies Revolutionized Data Centers and HPC Systems
11.12.2017 | Fraunhofer-Institut für Zuverlässigkeit und Mikrointegration IZM

nachricht Rules for superconductivity mirrored in 'excitonic insulator'
08.12.2017 | Rice University

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: Scientists channel graphene to understand filtration and ion transport into cells

Tiny pores at a cell's entryway act as miniature bouncers, letting in some electrically charged atoms--ions--but blocking others. Operating as exquisitely sensitive filters, these "ion channels" play a critical role in biological functions such as muscle contraction and the firing of brain cells.

To rapidly transport the right ions through the cell membrane, the tiny channels rely on a complex interplay between the ions and surrounding molecules,...

Im Focus: Towards data storage at the single molecule level

The miniaturization of the current technology of storage media is hindered by fundamental limits of quantum mechanics. A new approach consists in using so-called spin-crossover molecules as the smallest possible storage unit. Similar to normal hard drives, these special molecules can save information via their magnetic state. A research team from Kiel University has now managed to successfully place a new class of spin-crossover molecules onto a surface and to improve the molecule’s storage capacity. The storage density of conventional hard drives could therefore theoretically be increased by more than one hundred fold. The study has been published in the scientific journal Nano Letters.

Over the past few years, the building blocks of storage media have gotten ever smaller. But further miniaturization of the current technology is hindered by...

Im Focus: Successful Mechanical Testing of Nanowires

With innovative experiments, researchers at the Helmholtz-Zentrums Geesthacht and the Technical University Hamburg unravel why tiny metallic structures are extremely strong

Light-weight and simultaneously strong – porous metallic nanomaterials promise interesting applications as, for instance, for future aeroplanes with enhanced...

Im Focus: Virtual Reality for Bacteria

An interdisciplinary group of researchers interfaced individual bacteria with a computer to build a hybrid bio-digital circuit - Study published in Nature Communications

Scientists at the Institute of Science and Technology Austria (IST Austria) have managed to control the behavior of individual bacteria by connecting them to a...

Im Focus: A space-time sensor for light-matter interactions

Physicists in the Laboratory for Attosecond Physics (run jointly by LMU Munich and the Max Planck Institute for Quantum Optics) have developed an attosecond electron microscope that allows them to visualize the dispersion of light in time and space, and observe the motions of electrons in atoms.

The most basic of all physical interactions in nature is that between light and matter. This interaction takes place in attosecond times (i.e. billionths of a...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

Event News

See, understand and experience the work of the future

11.12.2017 | Event News

Innovative strategies to tackle parasitic worms

08.12.2017 | Event News

AKL’18: The opportunities and challenges of digitalization in the laser industry

07.12.2017 | Event News

 
Latest News

Midwife and signpost for photons

11.12.2017 | Physics and Astronomy

How do megacities impact coastal seas? Searching for evidence in Chinese marginal seas

11.12.2017 | Earth Sciences

PhoxTroT: Optical Interconnect Technologies Revolutionized Data Centers and HPC Systems

11.12.2017 | Information Technology

VideoLinks
B2B-VideoLinks
More VideoLinks >>>