The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data from other customers renting space on that same Amazon/Google/Microsoft cloud server, then marches onto another cloud server to repeat the attack, stealing untold volumes of data (SSL keys, passwords, logins, files etc) in the process.
While Meltdown can be patched, my understanding is that there is no short term solution to Spectre. That seems to make this problem very, very bad. Wouldn't that spell the death of the whole bussiness? On the other hand, my natural instinct in these situations is usually to try to dismiss it as hype.
- If I have a sensitive service running in a public cloud such as AWS, should I panic and take it offline right away to stop my SSL keys from being stolen?
- Is there anything cloud providers can do in the short to medium term to make their services reasonably safe?
- Is there (or can there be) virtualization software that is not vulnerable to Spectre even though the host system is?