Attacks/Breaches
4/25/2013
07:29 AM
Dark Reading
Dark Reading
Quick Hits
50%
50%

How Cybercriminals Attack The Cloud

What attacks are most likely against cloud computing environments? Here's a look -- and some advice

[Excerpted from "How Cybercriminals Attack the Cloud," a new report posted this week on Dark Reading's Cloud Security Tech Center.]

The adoption of cloud-based computing shows no signs of slowing. Indeed, cloud services are expanding at an incredible rate across all sectors of the economy, with the market for public cloud services expected to grow to $210 billion by 2016, according to Gartner.

And it's no wonder: The cloud is a compelling proposition for businesses and government agencies alike, offering easy access to shared, elastically allocated computing resources. The model creates savings on capital expenditures and reduces the running costs of operating a network, allowing enterprises to focus more on their core operations instead of IT.

However, what makes cloud computing so attractive to businesses -- the sharing of resources to achieve economies of scale -- also makes the model attractive to cybercriminals.

Cloud services concentrate so much data in one place that they become very attractive targets, justifying a large investment in a hacker's time and resources. Recent researchby the European Network and Information Securit Agency has led it to warn, "The proliferation of cloud computing and the sheer concentration of users and data on rather few logical locations are definitely an attractive target for future attacks."

What types of attacks are most common against cloud environments? Volumetric attacks aim to overwhelm a network's infrastructure with bandwidth-consuming

traffic or resource-sapping requests.

State-exhaustion attacks, such as TCP SYN flood and idle session attacks, abuse the stateful nature of TCP to exhaust resources in servers, load balancers and firewalls. Several cloud providers saw their firewalls fail last year during DDoS attacks.

Techniques such as amplification magnify the amount of bandwidth that can be used to target a potential victim. Suppose an attacker is able to generate 100 Mbps of traffic with his botnet. This may inconvenience or block access to a small site, but it would not impact a well-protected cloud hosted site or service.

The attacker could go to a botnet herder to rent access to its botnet, but this could get expensive. The attacker also could use manual and automated coordination techniques similar to those used by the Anonymous group, which notifies fellow "anons" of the time to start an attack so that it's big enough to affect the victim's resources.

By using an amplification technique called DNS reflection, an attacker's botnet can send out a DNS query of about 60 bytes to an open recursive DNS resolver that will gener-ate a response message sent to the victim of up to 4,000 bytes, increasing the amount of attack traffic by a factor of more than 60. The DNS protocol is ideal for this type of attack because queries can be sent with a spoofed source address -- using User Datagram Protocol, which doesn't require a handshake -- and a DNS response is significantly larger than the query itself.

To learn more about the different types of attacks made on cloud computing environments -- and what you can do about them -- download the free report.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.