Targeted attacks possible in the cloud, researchers warn

Network World reported last week, that the use of virtualization by cloud service providers using virtual systems on servers shared by multiple customers is opening up fresh data leak risks.

The article is based on a report by four researchers at MIT and the University of California at San Diego showing how vulnerabilities in cloud infrastructures could allow attackers to locate and eavesdrop on targeted virtual machines (VMs) anywhere in the cloud.

From the article:

The attack described in the report was conducted against Amazon's Elastic Computer Cloud (EC2) service. But the vulnerabilities that enable it are generic and would likely affect other cloud providers, said Eran Tromer, a post-doctoral researcher at MIT's Computer Science and Artificial Intelligence Laboratory and one of the authors of the report. The report is scheduled to be presented at the Association for Computing Machinery (ACM) Conference on Computer and Communications Security next month.

The research raises questions about a fundamental assumption about cloud computing which says that data hosted in a cloud is relatively safe from targeted attacks because it's hard to know where in the cloud the data is located. The research also comes at a time when concerns are high about security and privacy issues related to cloud computing.

This may be one more reason to reconsider that move to the cloud, or at least wait until better security can be devised for the cloud.