Featured Research

from universities, journals, and other organizations

Careless behaviour of cloud users leads to crucial security threats, experts find

Date:
June 20, 2011
Source:
Technische Universität Darmstadt
Summary:
Scientists in Germany have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

Scientists from the Darmstadt Research Center for Advanced Security (CASED) have discovered major security vulnerabilities in numerous virtual machines published by customers of Amazon's cloud. Among 1100 public Amazon Machine Images (AMIs), which are used to provide cloud services, about 30 percent are vulnerable, allowing attackers to manipulate or compromise web services or virtual infrastructures, the researchers say.

The main reason lies in the careless and error-prone manner in which Amazon's customers handle and deploy AMIs. CASED scientists have developed a vulnerability scanner for virtual machines that customers create to run on Amazon's infrastructure. It can be freely downloaded at http://trust.cased.de/AMID.

Cloud computing is becoming increasingly popular. More and more companies and private users are offering services in the cloud. While security experts have been mainly focusing on security aspects of the underlying cloud infrastructure and provider, it seems that in practice the threats caused by the cloud customers when constructing services are still underestimated or ignored. How severe the consequences resulting from wrong user behaviour can be, has now been shown by recent analysis carried out by the research group led by Prof. Ahmad-Reza Sadeghi at CASED.

The scientists at Fraunhofer SIT in Darmstadt and the System Security Lab at the Technische Universität Darmstadt examined services published by customers of Amazon Web Services (AWS). Even though AWS provide their customers with very detailed security recommendations on their web pages, the scientists found that at least one third of the machines under consideration have flawed configurations. The research team could extract security critical data such as passwords, cryptographic keys and certificates from the analyzed virtual machines. Attackers can use such information to operate criminal virtual infrastructures, manipulate web services or circumvent security mechanisms such as Secure Shell (SSH).

"The problem clearly lies in the customers' unawareness and not in Amazon Web Services. We believe that customers of other cloud providers endanger themselves and other cloud users similarly by ignoring or underestimating security recommendations," emphasizes Prof. Sadeghi. In coordination with the Amazon Web Services' security team the affected customers have been informed.


Story Source:

The above story is based on materials provided by Technische Universität Darmstadt. Note: Materials may be edited for content and length.


Cite This Page:

Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. ScienceDaily, 20 June 2011. <www.sciencedaily.com/releases/2011/06/110620095240.htm>.
Technische Universität Darmstadt. (2011, June 20). Careless behaviour of cloud users leads to crucial security threats, experts find. ScienceDaily. Retrieved April 24, 2014 from www.sciencedaily.com/releases/2011/06/110620095240.htm
Technische Universität Darmstadt. "Careless behaviour of cloud users leads to crucial security threats, experts find." ScienceDaily. www.sciencedaily.com/releases/2011/06/110620095240.htm (accessed April 24, 2014).

Share This



More Computers & Math News

Thursday, April 24, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Will New FCC Rules Trigger Death Of Net Neutrality?

Will New FCC Rules Trigger Death Of Net Neutrality?

Newsy (Apr. 24, 2014) — The Federal Communications Commission will reportedly propose new rules for Net neutrality that could undermine the principles of a free and open Web. Video provided by Newsy
Powered by NewsLook.com
Apple Beats Estimates, Most Looking to Second Half of 2014

Apple Beats Estimates, Most Looking to Second Half of 2014

TheStreet (Apr. 24, 2014) — TheStreet's Stephanie Link and Real Money Contributor Dan Nathan discuss Apple's first quarter results. Link and Nathan expected the tech giant to lower guidance for the current quarter which they felt could send shares lower and present a buying opportunity. Nathan says options are cheap because Apple has been aggressively buying back shares. Video provided by TheStreet
Powered by NewsLook.com
Raw: Obama Plays Soccer With Japanese Robot

Raw: Obama Plays Soccer With Japanese Robot

AP (Apr. 24, 2014) — President Obama briefly played soccer with a robot during his visit to Japan on Thursday. The President has been emphasizing technology along with security concerns during his visit. (April 24) Video provided by AP
Powered by NewsLook.com
Obama Encourages Japanese Student-Scientists

Obama Encourages Japanese Student-Scientists

AP (Apr. 24, 2014) — President Obama spoke with student innovators in Japan and urged them to take part in increased opportunities for student exchanges with the US. (April 24) Video provided by AP
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
 
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:  

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:  

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile iPhone Android Web
Follow Facebook Twitter Google+
Subscribe RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins