Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, KVM, VMWare ESXi and so on.
With actual dedicated hardware one can somewhat safely assume that the system itself has not been compromised if:
- the software can be assumed as safe, that is the software running on that machine (ssh, webserver, etc.) can be assumed to not have been exploited or brute-forced
- the hardware can be assumed as not-compromised, that is the machine hasn't gone offline so that an attacker could've changed essential hardware-parts like HDDs/RAM/etc with compromised ones. (Yes I know about hot-swappable hardware, but let's assume that will leave sufficient traces, be it in logs or software-malfunctions, if it's not done by a legitimate authority.)
But with virtual hardware the assumption that the hardware hasn't been compromised doesn't hold any more, because the hoster can pause, copy and restart the machine at will, without it ever rebooting or even going offline. Furthermore the hoster has direct access to the entire virtual machine's RAM and disks - while it is still running.
With some effort the hoster might even be able to change the authorized_keys or /etc/passwd file on the System to gain (root-)access to it and thus possibly even be able to view the contents of encrypted partitions that are currently mounted.
Given these vulnerabilites or possible attacks my questions now are:
How realistic are these vulnerabilities, are they an actual threat or just "science-fiction"? Is there anything that makes them impractical in reality? Do the VM-software vendors (Citrix, VMWare, etc.) implement any security mechanisms that make these attacks more difficult? (Is there even anything they can do to make this harder, other than security-by-obscurity)? Or do the VM-vendors maybe even provide tools to the hosters (which after all are their direct clients) that make these attacks easier?
Is there any effective way a guest-os can protect itself or the data in the RAM and on the disks from this kind of attacks? Would trusted computing approaches (signed code, etc.) be of any help? I know about DEP and ASLR, but that won't really stop the host from still reading every bit of memory available. Also I guess RAM-encryption is out of the question with conventional x86 hardware/VMs .. since that would no longer be "random-access" memory any more.
Has there been any research on this? I'm surprised about how little discussion there is on this topic. Is everything so obvious or unsolvable already, or is there just too little interest yet?