Attacks/Breaches
4/25/2013
07:29 AM
Dark Reading
Dark Reading
Quick Hits
Connect Directly
RSS
E-Mail
50%
50%

How Cybercriminals Attack The Cloud

What attacks are most likely against cloud computing environments? Here's a look -- and some advice

[Excerpted from "How Cybercriminals Attack the Cloud," a new report posted this week on Dark Reading's Cloud Security Tech Center.]

The adoption of cloud-based computing shows no signs of slowing. Indeed, cloud services are expanding at an incredible rate across all sectors of the economy, with the market for public cloud services expected to grow to $210 billion by 2016, according to Gartner.

And it's no wonder: The cloud is a compelling proposition for businesses and government agencies alike, offering easy access to shared, elastically allocated computing resources. The model creates savings on capital expenditures and reduces the running costs of operating a network, allowing enterprises to focus more on their core operations instead of IT.

However, what makes cloud computing so attractive to businesses -- the sharing of resources to achieve economies of scale -- also makes the model attractive to cybercriminals.

Cloud services concentrate so much data in one place that they become very attractive targets, justifying a large investment in a hacker's time and resources. Recent researchby the European Network and Information Securit Agency has led it to warn, "The proliferation of cloud computing and the sheer concentration of users and data on rather few logical locations are definitely an attractive target for future attacks."

What types of attacks are most common against cloud environments? Volumetric attacks aim to overwhelm a network's infrastructure with bandwidth-consuming

traffic or resource-sapping requests.

State-exhaustion attacks, such as TCP SYN flood and idle session attacks, abuse the stateful nature of TCP to exhaust resources in servers, load balancers and firewalls. Several cloud providers saw their firewalls fail last year during DDoS attacks.

Techniques such as amplification magnify the amount of bandwidth that can be used to target a potential victim. Suppose an attacker is able to generate 100 Mbps of traffic with his botnet. This may inconvenience or block access to a small site, but it would not impact a well-protected cloud hosted site or service.

The attacker could go to a botnet herder to rent access to its botnet, but this could get expensive. The attacker also could use manual and automated coordination techniques similar to those used by the Anonymous group, which notifies fellow "anons" of the time to start an attack so that it's big enough to affect the victim's resources.

By using an amplification technique called DNS reflection, an attacker's botnet can send out a DNS query of about 60 bytes to an open recursive DNS resolver that will gener-ate a response message sent to the victim of up to 4,000 bytes, increasing the amount of attack traffic by a factor of more than 60. The DNS protocol is ideal for this type of attack because queries can be sent with a spoofed source address -- using User Datagram Protocol, which doesn't require a handshake -- and a DNS response is significantly larger than the query itself.

To learn more about the different types of attacks made on cloud computing environments -- and what you can do about them -- download the free report.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio