Virtualization detection strategies and their outcomes in public clouds

Abstract

Virtualization detection on publicly exposed computing resources can have serious security implications. It can lead to the exploitation of known vulnerabilities in the virtualization software and also to carrying out attacks on shared virtual resources. The impact of such attacks can be very severe on public clouds, as numerous clients who subscribe to the cloud services share the infrastructure. Yet the threat of virtualization detection has been often overlooked by many cloud service providers. In this paper, we show how the three popular public clouds namely the Amazon EC2, Google Computing Engine and the Microsoft Azure clouds are vulnerable to this risk. We summarize the various approaches used for virtualization detection and present the results obtained on the public clouds from an attacker's perspective. We demonstrate that the publicly exposed guest instances are not hardened to prevent this information leakage to the attackers. In addition to the prior known approaches, we also propose and demonstrate a new approach for detecting virtualization, based on the location and size of the descriptor tables.