EC2 Dedicated Hosts

Re:EC2 Dedicated Hosts by toomuchtodo on Monday November 23, 2015 @08:06PM (#10618509)

I'll agree with this attack vector, although it'd be trivial to have your PXE boot routine between customers re-apply known good firmware to the NIC and disk controller and verify with checksums (unless there's a 0-day out there for the NIC controller, in which case you're owned regardless).

[ Parent | on HN ]

Re:EC2 Dedicated Hosts by teraflop on Monday November 23, 2015 @09:04PM (#10618714)

Normally the PXE boot code is, itself, stored in firmware.

[ Parent | on HN ]

Re:EC2 Dedicated Hosts by toomuchtodo on Monday November 23, 2015 @10:24PM (#10618968)

Whatever components start first, wins. If the PXE boot code is in the NIC, you can theoretically verify the rest of the system first. If its in the BIOS, the BIOS needs to trust the NIC as untrusted/determine if its compromised or not.

Security is hard :/

[ Parent | on HN ]

Re:EC2 Dedicated Hosts by XorNot on Tuesday November 24, 2015 @03:02AM (#10619660)

ROM based NIC? Why not? If you're going into large scale dedicated servers, this is not exactly impractical. You could probably also just disconnect the flash enable pins on the ICs.

[ Parent | on HN ]

Re:EC2 Dedicated Hosts by hueving on Monday November 23, 2015 @08:21PM (#10618556)

Assuming the firmware has no say in the flashing process.

[ Parent | on HN ]