Featured Research

from universities, journals, and other organizations

Careless behaviour of cloud users leads to crucial security threats, experts find

Date:
June 20, 2011
Source:
Technische Universität Darmstadt
Summary:
Scientists in Germany have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

Scientists from the Darmstadt Research Center for Advanced Security (CASED) have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

The main reason lies in the careless and error-prone manner in which Amazon's customers handle and deploy AMIs. CASED scientists have developed a vulnerability scanner for virtual machines that customers create to run on Amazon's infrastructure. It can be freely downloaded at http://trust.cased.de/AMID.

Cloud computing is becoming increasingly popular. More and more companies and private users are offering services in the cloud. While security experts have been mainly focusing on security aspects of the underlying cloud infrastructure and provider, it seems that in practice the threats caused by the cloud customers when constructing services are still underestimated or ignored. How severe the consequences resulting from wrong user behaviour can be, has now been shown by recent analysis carried out by the research group led by Prof. Ahmad-Reza Sadeghi at CASED.

The scientists at Fraunhofer SIT in Darmstadt and the System Security Lab at the Technische Universität Darmstadt examined services published by customers of Amazon Web Services (AWS). Even though AWS provide their customers with very detailed security recommendations on their web pages, the scientists found that at least one third of the machines under consideration have flawed configurations. The research team could extract security critical data such as passwords, cryptographic keys and certificates from the analyzed virtual machines. Attackers can use such information to operate criminal virtual infrastructures, manipulate web services or circumvent security mechanisms such as Secure Shell (SSH).

"The problem clearly lies in the customers' unawareness and not in Amazon Web Services. We believe that customers of other cloud providers endanger themselves and other cloud users similarly by ignoring or underestimating security recommendations," emphasizes Prof. Sadeghi. In coordination with the Amazon Web Services' security team the affected customers have been informed.


Story Source:

The above story is based on materials provided by Technische Universität Darmstadt. Note: Materials may be edited for content and length.


Cite This Page:

Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. ScienceDaily, 20 June 2011. <www.sciencedaily.com/releases/2011/06/110620095240.htm>.
Technische Universität Darmstadt. (2011, June 20). Careless behaviour of cloud users leads to crucial security threats, experts find. ScienceDaily. Retrieved September 20, 2014 from www.sciencedaily.com/releases/2011/06/110620095240.htm
Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. www.sciencedaily.com/releases/2011/06/110620095240.htm (accessed September 20, 2014).

Share This



More Computers & Math News

Saturday, September 20, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

How Much Privacy Protection Will Google's Android L Provide?

How Much Privacy Protection Will Google's Android L Provide?

Newsy (Sep. 19, 2014) — Google's local encryption will make it harder for law enforcement or malicious actors to access the contents of devices running Android L. Video provided by Newsy
Powered by NewsLook.com
Virtual Reality Headsets Unveiled at Tokyo Game Show

Virtual Reality Headsets Unveiled at Tokyo Game Show

AFP (Sep. 18, 2014) — Several companies unveiled virtual reality headsets at the Tokyo Game Show, Asia's largest digital entertainment exhibition. Duration: 00:48 Video provided by AFP
Powered by NewsLook.com
What HealthKit Bug Means For Your iOS Fitness Apps

What HealthKit Bug Means For Your iOS Fitness Apps

Newsy (Sep. 18, 2014) — Apple has delayed the launch of the HealthKit app platform, citing a bug. Video provided by Newsy
Powered by NewsLook.com
Apple's iOS8 Includes New 'Killswitch' To Curb Theft

Apple's iOS8 Includes New 'Killswitch' To Curb Theft

Newsy (Sep. 18, 2014) — Apple's new operating system, iOS 8, comes with Apple's killswitch feature already activated, unlike all the models before it. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
 
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:  

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:  

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile iPhone Android Web
Follow Facebook Twitter Google+
Subscribe RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins