News for hackers. Stuff that matters.

A comment on How your data gets compromised in an IaaS cloud: Vendor tells all. Parent comment

Re:How your data gets compromised in an IaaS cloud: Vendor t... by cloudsigma on Sunday December 05, 2010 @10:13AM (#1971741)
Our post is regarding IaaS clouds in general and has nothing specifically to do with EC2 or any other particular vendor. It may be the case that EC2 does have secure measures in place; I wonder how many of their customers can articulate them (or customers of other IaaS clouds for that matter)? We are merely raising an important issue. You can look at the many other posts we have on the other various aspects of security in the cloud of which this post forms the latest instalment regarding data storage.

"there are more efficient ways than encryption or "full sweep overwrite" to address this at the storage-level."

Your suggestion would be?

Kind regards,

Patrick

[ Parent | on HN ]
Re:How your data gets compromised in an IaaS cloud: Vendor t... by moe on Sunday December 05, 2010 @10:45AM (#1971796)
Your suggestion would be?

See my reply above about using a loopback-file.

It's a one-liner:

  dd if=/dev/zero of=/vols/customer123/vol234 seek=$SIZE bs=1 count=1
There's surely quite a few other ways to skin this cat (eventually arriving at the multi-tenancy features in proprietary SAN appliances), but this seems the most obvious one.
[ Parent | on HN ]
Re:How your data gets compromised in an IaaS cloud: Vendor t... by cloudsigma on Sunday December 05, 2010 @10:26AM (#1971768)
Vukk,

The issue there is more about tracking. You'd have to track every single block and return zero for any that hadn't been used/altered since drive creation. I'm guessing it would prove pretty costly in terms of latency for drive access after initial drive creation but its a good idea potentially. I'll pass it onto our technical guys as well to ask about its feasibility.

Best wishes,

Patrick

[ Parent | on HN ]
Re:How your data gets compromised in an IaaS cloud: Vendor t... by vukk on Sunday December 05, 2010 @10:21AM (#1971754)
Since we are not directly accessing the HDD, couldn't the virtualization layer say if(disk block not written before) return 0; and thus the customer wouldn't have to worry? Or is this too inefficient?
[ Parent | on HN ]