Cloud computing: Gaps in the 'cloud'

Oct 24, 2011 by Jens Wylkop

Researchers from Ruhr-University Bochum have found a massive security gap at Amazon Cloud Services. Using different methods of attack (signature wrapping and cross site scripting) they tested the system which was deemed "safe". "Based on our research results, Amazon confirmed the security gaps and closed them immediately", said Prof. Dr. Jorg Schwenk, chair for network and data security at the RUB. Amazon Webservices (AWS) offers its customers cloud computing services and hosts, among others, services like Twitter, Second Life and 4Square.

Cloud computing could be the major computing paradigm of tomorrow. The idea of processing and storing software and data in a cheap external infrastructure is becoming increasingly popular. The fact that these services are by no means as secure as promised is now demonstrated by the research results of Prof. Schwenk and his staff.

The "Cloud" is a collection of many virtual servers with concentrated . Outsourcing to cloud computing has many advantages for professional users: they can rent storage and server capacity short term on demand. The service is invoiced, for example, according to the usage period, and the customer saves the cost of purchasing his own software and hardware. Up to now, the discussion about cloud computing has above all been dominated by the inability to comply with legal requirements. "Real" attacks were, however, less in the public eye.

"A major challenge for cloud providers is ensuring the absolute of the data entrusted to them, which should only be accessible by the clients themselves," said Prof. Schwenk, who set out with his staff to seek weak points. They have found what they were looking for: Juraj Somorovsky, Mario Heiderich and Meiko Jensen tested the security concept of the cloud provider Amazon Web Services, in short AWS.

"Using different kinds of XML signature wrapping attacks, we succeeded in completely taking over the administrative rights of cloud customers", said Juraj Somorovsky. "This allowed us to create new instances in the victim's cloud, add or delete images." The researchers suspect that many cloud offers are susceptible to signature wrapping attacks, since the relevant web service standards make performance and security incompatible. "We are working on a high-performance solution, however, that no longer has any of the known security gaps", said Prof. Dr. Jörg Schwenk.

In addition, the researchers found gaps in the AWS interface and in the Amazon shop which were ideally suited for smuggling in executable script code - what are termed cross-site scripting attacks. With alarming consequences: "We had free access to all customer data, including authentication data, tokens, and even plain text passwords" said Mario Heiderich. The researcher see the common login as a complex potential danger: "It's a chain reaction. A security gap in the complex Amazon shop always also directly causes a gap in the Amazon cloud."

In contrast to public belief, Private Clouds are also vulnerable to the aforementioned attacks: Eucalyptus, an open source project widely used to implement Cloud solutions within companies, did expose the same weaknesses. "A rough classification of cloud technologies cannot replace a thorough security investigation", states Prof. Schwenk.

"Critical services and infrastructures are making increasing use of cloud computing", explained Juraj Somorovsky. According to industry estimates, the turnover of European cloud services is set to more than double in the next four years – from around 68 billion Euros in 2010 to about 148 billion in 2014. "Therefore it is essential that we recognise the security gaps in and avoid them on a permanent basis." Industry took immediate action: "On our advice, Amazon and Eucalyptus confirmed the security gaps and closed them immediately".

Explore further: Google's Street View address reading software also able to decipher CAPTCHAs

Provided by Ruhr-University Bochum

not rated yet
add to favorites email to friend print save as pdf

Related Stories

Study on the Security of Cloud Computing

Feb 26, 2010

Not only does cloud computing help to save money, it also helps to increase IT security: Small and medium sized companies especially can profit from special cloud security solutions and the knowledge advantage of experienced ...

Sun Microsystems to offer 'public cloud' service

Mar 18, 2009

(AP) -- Taking a cue from Amazon.com, Sun Microsystems Inc. plans to launch its own "public cloud" service, which will let everyone from big-time corporations to dorm-room entrepreneurs run their businesses on Sun's computers ...

CeBIT 2011: Administration in the cloud

Feb 10, 2011

The emerging field of cloud computing is an interesting one, and not just for businesses. The field of public administration benefits from the technology as well. Fraunhofer Institutes are developing solutions ...

Recommended for you

User comments : 0

More news stories

LinkedIn membership hits 300 million

The career-focused social network LinkedIn announced Friday it has 300 million members, with more than half the total outside the United States.

Researchers uncover likely creator of Bitcoin

The primary author of the celebrated Bitcoin paper, and therefore probable creator of Bitcoin, is most likely Nick Szabo, a blogger and former George Washington University law professor, according to students ...

Under some LED bulbs whites aren't 'whiter than white'

For years, companies have been adding whiteners to laundry detergent, paints, plastics, paper and fabrics to make whites look "whiter than white," but now, with a switch away from incandescent and fluorescent lighting, different ...

Plants with dormant seeds give rise to more species

Seeds that sprout as soon as they're planted may be good news for a garden. But wild plants need to be more careful. In the wild, a plant whose seeds sprouted at the first warm spell or rainy day would risk disaster. More ...

Foreigner dies of MERS in Saudi

A foreigner has died after she contracted MERS in the Saudi capital, the health ministry said on announced Friday, bringing the nationwide death toll to 73.

Impact glass stores biodata for millions of years

(Phys.org) —Bits of plant life encapsulated in molten glass by asteroid and comet impacts millions of years ago give geologists information about climate and life forms on the ancient Earth. Scientists ...

Researchers successfully clone adult human stem cells

(Phys.org) —An international team of researchers, led by Robert Lanza, of Advanced Cell Technology, has announced that they have performed the first successful cloning of adult human skin cells into stem ...