Analyzing Infrastructure as Code to Prevent Intra-update Sniping Vulnerabilities
Analyzing Infrastructure as Code to Prevent Intra-update Sniping Vulnerabilities
复制标题
分析基础架构作为防止更新内狙击漏洞的代码
DOI：
10.1007/978-3-030-72013-1_6
复制
发表时间：
2021-02-26
期刊：
影响因子：
--
通讯作者：
Santolucito M
中科院分区：
文献类型：
--
作者：
Lepiller J;Piskac R;Schäf M;Santolucito M
基础架构作为计算基础架构管理的一种新方法，允许用户利用版本控制，自动部署和基础架构配置的程序分析。 ，例如云形式或Terraform，使用声明性模型，以便用户只需要描述所需的状态但是，在升级期间，基础架构在升级期间没有原子处理。很安全，我们证明了亚马逊的AWS和Google Cloud可以使用这些漏洞我们在使用数据流程分析的工具Häyhä中实现了此技术。
Infrastructure as Code is a new approach to computing infrastructure management that allows users to leverage tools such as version control, automatic deployments, and program analysis for infrastructure configurations. This approach allows for faster and more homogeneous configuration of a complete infrastructure. Infrastructure as Code languages, such as CloudFormation or TerraForm, use a declarative model so that users only need to describe the desired state of the infrastructure. However, in practice, these languages are not processed atomically. During an upgrade, the infrastructure goes through a series of intermediate states. We identify a security vulnerability that occurs during an upgrade even when the initial and final states of the infrastructure are secure, and we show that those vulnerability are possible in Amazon’s AWS and Google Cloud. We call such attacks intra-update sniping vulnerabilities. In order to mitigate this shortcoming, we present a technique that detects such vulnerabilities and pinpoints the root causes of insecure deployment migrations. We implement this technique in a tool, Häyhä, that uses dataflow graph analysis. We evaluate our tool on a set of open-source CloudFormation templates and find that it is scalable and could be used as part of a deployment workflow.
登录
查看更多内容
影响因子：
16.6
作者：
Huang, Wei;Ganjali, Afshar;Lie, David
通讯作者：
Lie, David
影响因子：
1.8
作者：
Raad, Azalea;Doko, Marko;Vafeiadis, Viktor
通讯作者：
Vafeiadis, Viktor
影响因子：
1.8
作者：
Parker, James;Vazou, Niki;Hicks, Michael
通讯作者：
Hicks, Michael
影响因子：
1.8
作者：
Santolucito, Mark;Zhai, Ennan;Piskac, Ruzica
通讯作者：
Piskac, Ruzica
影响因子：
--
作者：
Ball, Thomas;Bjorner, Nikolaj;Valadarsky, Asaf
通讯作者：
Valadarsky, Asaf