Featured Research

from universities, journals, and other organizations

Careless behaviour of cloud users leads to crucial security threats, experts find

Date:
June 20, 2011
Source:
Technische Universität Darmstadt
Summary:
Scientists in Germany have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

Scientists from the Darmstadt Research Center for Advanced Security (CASED) have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

Related Articles


The main reason lies in the careless and error-prone manner in which Amazon's customers handle and deploy AMIs. CASED scientists have developed a vulnerability scanner for virtual machines that customers create to run on Amazon's infrastructure. It can be freely downloaded at http://trust.cased.de/AMID.

Cloud computing is becoming increasingly popular. More and more companies and private users are offering services in the cloud. While security experts have been mainly focusing on security aspects of the underlying cloud infrastructure and provider, it seems that in practice the threats caused by the cloud customers when constructing services are still underestimated or ignored. How severe the consequences resulting from wrong user behaviour can be, has now been shown by recent analysis carried out by the research group led by Prof. Ahmad-Reza Sadeghi at CASED.

The scientists at Fraunhofer SIT in Darmstadt and the System Security Lab at the Technische Universität Darmstadt examined services published by customers of Amazon Web Services (AWS). Even though AWS provide their customers with very detailed security recommendations on their web pages, the scientists found that at least one third of the machines under consideration have flawed configurations. The research team could extract security critical data such as passwords, cryptographic keys and certificates from the analyzed virtual machines. Attackers can use such information to operate criminal virtual infrastructures, manipulate web services or circumvent security mechanisms such as Secure Shell (SSH).

"The problem clearly lies in the customers' unawareness and not in Amazon Web Services. We believe that customers of other cloud providers endanger themselves and other cloud users similarly by ignoring or underestimating security recommendations," emphasizes Prof. Sadeghi. In coordination with the Amazon Web Services' security team the affected customers have been informed.


Story Source:

The above story is based on materials provided by Technische Universität Darmstadt. Note: Materials may be edited for content and length.


Cite This Page:

Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. ScienceDaily, 20 June 2011. <www.sciencedaily.com/releases/2011/06/110620095240.htm>.
Technische Universität Darmstadt. (2011, June 20). Careless behaviour of cloud users leads to crucial security threats, experts find. ScienceDaily. Retrieved November 27, 2014 from www.sciencedaily.com/releases/2011/06/110620095240.htm
Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. www.sciencedaily.com/releases/2011/06/110620095240.htm (accessed November 27, 2014).

Share This


More From ScienceDaily



More Computers & Math News

Thursday, November 27, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

EU Pushes Google For Worldwide Right To Be Forgotten

EU Pushes Google For Worldwide Right To Be Forgotten

Newsy (Nov. 27, 2014) — Privacy regulators recommend Google expand its requested removals to apply to all its web domains. Video provided by Newsy
Powered by NewsLook.com
Predictions Of Tablets' Demise Sound Familiar

Predictions Of Tablets' Demise Sound Familiar

Newsy (Nov. 26, 2014) — The tablet's days are numbered, at least according to a recent IDC report. The market-research firm paints a grim outlook for tablets. Video provided by Newsy
Powered by NewsLook.com
Today's Prostheses Are More Capable Than Ever

Today's Prostheses Are More Capable Than Ever

Newsy (Nov. 26, 2014) — Advances in prosthetics are making replacement body parts stronger and more lifelike than they’ve ever been. Video provided by Newsy
Powered by NewsLook.com
FCC Forces T-Mobile To Alert Customers Of Data Throttling

FCC Forces T-Mobile To Alert Customers Of Data Throttling

Newsy (Nov. 25, 2014) — T-Mobile and the FCC have reached an agreement requiring the company to alert customers when it throttles their data speeds. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
 
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:  

Breaking News:

Strange & Offbeat Stories

 

Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:  

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile iPhone Android Web
Follow Facebook Twitter Google+
Subscribe RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins