0

Imagine a hosted database in public cloud. The database records are encrypted only on disk (data-at-rest). Are there are any attacks that steal the database records from the memory (when queries are being executed etc? )?

Especially am looking for threat vectors opened up due to virtualization and cloud. I read about RAM Scraping etc on POS Terminals but not sure if there are attacks feasible on a remote virtual machines in cloud

Improve this question
3
  • 1
    Simple: escalate to root, dump memory. I don't get your question.
    – Deer Hunter
    Mar 2, 2016 at 5:08
  • so an attacker needs to find some way to enter the VM and escalate to root ?
    – sashank
    Mar 2, 2016 at 5:16
  • 1
    SQLi on an insecure web app can allow someone to steal database records, but that isn't cloud-specific, just like gaining root. If you are focused on vulnerabilities inherent in VMs, then you are looking at vulnerabilities that can only be exploited with physical access to the running VM, or through a vulnerability in the hypervisor. If this is the case, then you need to reword your question.
    – schroeder ♦
    Mar 2, 2016 at 5:48

1 Answer 1

Reset to default
2

Stealing data living on one VM directly from another VM is not a realistic attack scenario currently. While there are side channels which allow a small information leakage it is currently more a theoretical and expensive thing to exfiltrate data that way.

Much more likely are attacks directly against the VM containing the data (i.e. SQL injection, SSH brute force....). There is nothing special VM or cloud related with these attacks, i.e. once you have system privileges or even kernel privileges you can access the memory of any process.

Less likely but still realistic are attacks against the hypervisor, like breaking out of a neighbor VM or attacking the system where the hypervisor runs on. Once you got system or kernel privileges on the hypervisor this way you get full access to all VM's in control of the hypervisor. This includes full access to the memory of these VM.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .