Hacker News Reader

Comment by C1sc0cat | Hacker News Reader

Shows the advantage of on prem vs cloud

It's just the medium, your servers are vulnerable no matter on prem or cloud.

If it's connected, it's vulnerable.

With sophisticated attacks like these, I won't be surprised if some of these stolen data were/are on air-gapped servers.

Wouldn't that require physical intervention?

Yes, but it can be innocent physical intervention.

With airgapped servers, the question is, how do you install updates? There's almost always a way; IT needs it. With those updates, you can get an attack, if the machine supplying the update has been compromised.

For example, even if the update comes via a DVD, some machine wrote the DVD. If you can corrupt that machine, you can corrupt the DVD. Now you have a way to (eventually) get hostile code on the airgapped server.

The authors of SPECTRE, Meltdown, Rowhammer (1-4),and whatever else is next would probably disagree with you. Running in cloud providers absolutely without doubt exposes your presence to hostile neighbors scheduled on the same hyoervisor.

None of these attacks seemed to use the speculative execution vulnerabilities. They're not very relevant here

No, you're missing the point. The comment I replied to said, "your servers are vulnerable no matter on prem or cloud." If you're in the cloud, you're vulnerable to an entire suite of attacks that you're not exposed to on-prem. That's my point.

I could care less what was used in the attack detailed by the article. I was replying to a specific comment, not the article.

Security is all about making the best compromises and shoring up the weakest links.

SPECTRE, Meltdown, Rowhammer are just a few risks amongst thousands. Most importantly they at least have runtime signatures that could be detected.

There are weaker areas for directed attacks against an organisation (e.g. spear-fishing).

When attacked by highly skilled, highly motivated, highly resourced and foreign opponents, an org may find they are better relying upon an external team for securing your VMs. I would expect Google Cloud to be far better than the majority of fortune 500 companies at securing hypervisors and VMs.

a) You're ignoring the "and whatever else is next" part of my statement. If you're on-prem, you don't need to worry about hostile neighbors. Google Cloud engineers could be great at securing public cloud workloads, but even they don't know what's yet to be found.

b) You're not running untrusted, random stranger code on your Fortune 500 VM's. I can't signup for an account on Ford's VM's and start ripping through memory like I can with a public cloud.

It's true in general. In practice, hosting memory-safe apps on OpenBSD rarely gets people hacked. If ever. You can also pick a better processor (AMD vs Intel) or even an obscure one like Freescale's PPC's that these hackers might not be able to exploit yet.

As long as more than a trivial number of people need to access your application from a network that is bigger than one room, your application is at risk.

But definitely running in public shared cloud exposes you to certain kinds of attack vectors that are not present in an on-prem deployment.

But it also protects you from certain types of attack vectors that your on-prem may not.

For example, you can be a co-incidental victim of a mass hack of public cloud. But it would be difficult to target your specific machines in the cloud (assuming your application surface is secure) but it might be easier when you are on-prem (easy to locate, isolate and infiltrate etc).

While "your servers are vulnerable no matter on prem or cloud" is true - there are some sitautions in which the cloud has other risks I never considered until it was an issue.

We had a set of sites on a special hardened security wise anti=hack anti ddos platform... and when that cloud got hacked they got all of our stuff and everyone else's and put it all on the dark net I believe. This was apparently because one of their customers was a semi-high profile target..

We found out a couple days later when the credit card on file started being used around the world, and that card had only ever been used at 2 places. We were not notified by the company.

We did read about it in a story a couple days later that named our hosting company in a sidenote when noting the one client that was hacked / defaced / exposed whatever.

Sadly in this case we would of been better off with non-cloud, non-extra-secure hosting.

As others have said, if it's connected it's vulnerable, I agree. There are different risks for different hosting situations.

HPE cloud at least

Yeah, I would be more surprised if one of the big 3 was compromised.

Not saying it couldn't happen, it just seems unlikely.

Reply on news.ycombinator.com