CoResident Evil: Covert Communication In The Cloud With Lambdas

Abstract

Serverless" cloud services, such as AWS lambdas, are one of the fastest growing segments of the cloud services market. These services are popular in part due to their light-weight nature and flexibility in scheduling and cost, however the security issues associated with serverless computing are not well understood. In this work, we explore the feasibility of constructing a practical covert channel from lambdas. We establish that a fast co-residence detection for lambdas is key to enabling such a covert channel, and proceed to develop a reliable and scalable co-residence detector based on the memory bus hardware. Our technique enables dynamic discovery for co-resident lambdas and is incredibly fast, executing in a matter of seconds. We evaluate our approach for correctness and scalability, and use it to establish covert channels and perform data transfer on AWS lambdas. We show that we can establish hundreds of individual covert channels for every 1000 lambdas deployed, and each of those channels can send data at a rate of200 bits per second, thus demonstrating that covert communication via lambdas is entirely feasible. CCS CONCEPTS• Security and privacy → Virtualization and security.

Serverless computing: a security perspective

“…In the case of public clouds, it is relatively easy for such adversaries to deploy malicious functions in order to attempt to perform attacks from the inside. These adversaries can attempt to: i. create covert channels [20,21]; ii. conduct privilege escalation attacks (e.g., to compromise other co-resident functions or worker nodes) [22]; iii.…”

The Rise of Serverless Architectures: Security Challenges and Best Practices

“…Consequently, other container technologies, such as Docker, were proposed as a more lightweight alternative [13,14]. Containers have several advantages over virtual machines (VMs) in terms of enhanced portability, reduced start-up time, and improved resource usage [15,16]. These benefits contribute to the streamlining of the development and administration processes for large-scale applications deployed in cloud environments.…”