Cloak & Co-locate: Adversarial Railroading of Resource Sharing-based Attacks on the Cloud
Cloak & Co-locate: Adversarial Railroading of Resource Sharing-based Attacks on the Cloud
复制标题
披风
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
H. Homayoun
中科院分区：
文献类型：
--
作者：
Hosein Mohammadi Makrani;H. Sayadi;Najmeh Nazari;Khaled N. Khasawneh;Avesta Sasan;S. Rafatirad;H. Homayoun
云上资源的异构性和应用程序的多样性激发了对资源供应系统（RPS）的需求，以满足用户的性能需求，同时最大化资源利用率以实现成本效益。另一方面，基于资源共享的攻击，例如侧通道攻击、瞬时执行攻击、行锤攻击和拒绝服务攻击，会利用共享资源泄露敏感数据或损害受害者的性能。尽管一旦攻击者虚拟机 (VM) 与受害者 VM 共置，在云上发起基于资源共享的攻击就很简单，但与受害者共置的要求限制了在云上基于资源共享的攻击的实用性。在本文中，我们展示了可以利用 RPS 来解决云中基于资源共享的攻击的共置挑战。特别是，我们提出了一种名为“Cloak & Co-locate”的新攻击，它利用对抗性规避攻击迫使 RPS 将攻击者的虚拟机与目标受害者的虚拟机共置。具体来说，Cloak 是一个假跟踪生成器 (FTG)，它包裹在对手内核中，以强制 RPS 将其与特定受害者的虚拟机共置，同时也逃避 RPS 的检测和迁移。
The heterogeneity of resources and the diversity of applications on the cloud motivated the need for resource provisioning systems (RPSs) to meet the users’ performance requirements while maximizing the resource utilization to achieve cost-efficiency. On the other hand, resource sharing-based attacks, such as side-channel, transient execution, rowhammer, and denial of service attacks, exploit shared resources to leak sensitive data or hurt the performance of a victim. Although mounting resource sharing-based attacks on the cloud is trivial once the attacker virtual machine (VM) is co-located with the victim VM, the co-location requirement with the victim limit the practicality of resource sharing-based attacks on the cloud. In this paper, we show that RPSs can be exploited to solve the co-location challenge of resource sharing-based attacks in the cloud. In particular, we propose a new attack, called Cloak & Co-locate, which utilize adversarial evasion attacks to force RPSs to co-locate attackers’ VMs with targeted victims’ VMs. Specifically, Cloak is a fake trace generator (FTG) that is wrapped around an adversary kernel in order to force RPSs to Co-locate it with a specific victim’s VM, while also evading from detection and migration by the RPS.