Mulligan Security - 21 / 01 / 2025

How safe am I from my cloud provider?

Since the 2010's VPS have become cheaper and widely available. From your local mom and pop datacenter where you can rent a baremetal Pi equivalent to highly secured Amazon datacenters and on-demand cpu/bandwidth allocation you can now find a broad range of options for your operational and security needs.

If clandestinity is a requirement, there also are cryptocurrency-based options in jurisdictions without LEO cooperation treatises with your own.

But, what if the adversary is already inside?
in this post we are going to do a threat modelling exercise:

Context and assumptions: what are the capabilities of our adversary? what about our own OPSEC requirments?

Threats: what the adversary might want to acomplish (their goal)

Attack Scenarii: a quick list of possible attacks

Mitigation measures: what we can do to make those attack uneconomical, harder

Context and assumptions

Setting up the scene

Alice wishes to start hosting a coordination platform for her activist group, but she doesn't want to host the platform herself for the following reasons:

Shes does not want to have incriminating data in her house
She is unable to provide the required level if high availability for her group's safety and operational standards
She has limited bandwidth/electricity to devote to her cause

She gets in touch with Bob, owner and operator of Bob's friendly datacenter, and orders from him a VPS (Virtual Private Server). Bob's pretty open-minded so Alice is free to use whatever OS she wants, gets a public IP.

Enters Leo

One day Bob's phone rings, it's Leo calling! Leo asks Bob to confirm that he indeed has Alice as a customer. Without further ado, Leo pays Bob a visit! After entering the premises and showing a government agency badge, Leo asks for complete access to Bob's infrastructure and binds him with a gag order to make sure no one hears about his investigation. Even if Bob is sympathetic to Alice or wishes to protect his customers he would now run afoul of his country's laws if he were to warn them. Leo might have been nice to him but he is not to be trifled with...

Leo sets up shop

Commandeering an office in Bob's datacenter, Leo gets to work. He has plenty of options:

Network sniffing: Leo can capture and log ALL trafic related to Alice's activity inside Bob's datacenter, so he will know the IP of everyone interacting with her platform
Firmware/hardware attacks: during maintenance windows, Leo could tamper with the BIOS/UEFI of Alice's server (if she had chosen a bare-metal option), or with her server's storage devices in order to deactivate encryption or exfiltrate data unnoticed
Memory attacks: Leo is able to take snapshots of Alice's VPS RAM to gather information about her activities. If she had chosen a bare-metal server he could cut the power, extract and refrigerate the RAM sticks in order to retrieve the data, but such an attack would be very conspicuous

Alice's threat model

Alice is very happy with her new deployment. The platform runs great and her team has started using it in earnest. Still, the bond of implicit trust that now exists between her and Bob bothers here. She decides to do a quick threat modelling exercise to calm her mind: instead of wondering about whatifs, she is going to identify the risks associated with her current setup and find ways to mitigate them.
Threats to Confidentiality
If Bob was dishonest (or compelled into acting dishonestly), he would be able to harvest information directly from her server's memory! (She doesn't know Leo is already hard at work)

Impacted assets

decryption keys (eg: her https private key, allowing for complete decryption of her team's traffic)

sensitive data (ephemeral private messages on her forum that arer only kepy in RAM in an unencrypted form)

software state (session cookies, metadata)

Bob could also use side-channel attacks by monitoring the underlying server's power usage or run cache timing attack to find the value of her cryptographic secret keys even if Bob's hardware allows her to store them in a dedicated secure chip!
Threats to integrity
Someone with Bob's level of access (he is the administrator of the hypervisor - the software that runs Alice's virtual server) could also:

Run an evil maid attack: inject thir own code in the bootloader, in Alice's OS image or inside the hypervisor which Alice can't monitor

Through the hypervisor, tamper with Alice's virtual machine to compromise it

Threats to availability
Having access to the physical layer of the network as well as the power grid feeding the servers, Bob could disrupt Alice's operations in the following way:

Disconnect Alice's VM from the network

Throttle Alice's network traffic

Cut the power off to Alice's host server to perform a cold boot attack

Attack scenarii

Having finished her thread enumeration, Alice's decides to focus her efforts on three most probable/most damaging scenarii to protect herself and her organization.

Live RAM extraction

Attack

Bob powers down the serve hosting the vps and extracts its RAM, refrigerate it to analyze its contents

Countermeasures

This one is very tricky and can't be addressed without renting a bare-metal server instead. Alice would need hardware that supports RAM encryption (such as AMD SEV and SME).

This attack is both costly and obvious as it requires the server to go offline. Alice's decides to accept the risk for now and reevaluate based on the evolving sensitivity of the data stored on her VPS.

BMC Exploitation

Attack

Nihilism

Until there is Nothing left.

Creative Commons Zero: No Rights Reserved

My Links

RSS Feed
SimpleX Chat

About Mulligan Security

Donate XMR:
86NCojqYmjwim4NGZzaoLS2ozbLkMaQTnd3VVa9MdW1jVpQbseigSfiCqYGrM1c5rmZ173mrp8RmvPsvspG8jGr99yK3PSs

Contact: mulligansecurity@riseup.net
website