back to article Microsoft movie tried to Azure Ignite attendees about CPU side-channel flaws, but biz wouldn't be drawn on details

How does Microsoft mitigate the risk of speculative-execution bugs on its Azure platform? The US goliath is unwilling to comment, despite running a session at its Ignite conference last month on exactly this subject. The Ignite session itself was titled "Spectre/Meltdown: An Azure retrospective" and talked about "how the …

  1. Pascal Monett Silver badge

    "We could never ever put our customers at risk"

    Bold words. Especially when, just a few paragraphs later, it is said that no, Azure does not turn off hyperthreading. You can talk mitigations 'till the pigeons come home to roost, you're putting your clients at risk.

    That being said, and my having already stated that I cannot, for the life of me, turn off hyperthreading, I'm wondering just exactly how much of a risk it really is. Is an Azure server always a Windows platform ? If it is Linux, that's already a lot of malware that is ineffective. Is there an actual exploit in the wild, being used at this time ?

    I'm not saying that the side-channel attack is a figment of imagination, I'm just wondering how easy it is to actually implement and get data out of from a hacker's point of view.

    1. phuzz Silver badge

      Re: "We could never ever put our customers at risk"

      If they used the same mitigation as the other cloud providers, ie, only allowing one customer's VMs per processor, then that should work, regardless of Hyperthreading (or SMT etc.). An attacker could only attack their own VMs.

      (Unless they'd somehow gained access to one particular machine belonging to a target company, in which case they could potentially use speculative execution to move laterally to other servers owned by the same company. Of course, there would probably be easier more conventional ways of doing that).

      As far as I know, the Azure hypervisor is based on Windows Hyper V, but the majority of VMs are Linux. Either way, any malware trying to make use of speculative execution would probably have to be custom written for a particular cloud platform.

      Given that the most likely scenario is an attacker creating a malicious VM in an attempt to steal information out of other VMs on the same CPU, I wouldn't be surprised if the attacking VM was running some variety of linux because that's the OS I've seen most PoC code running on..

      1. Claptrap314 Silver badge

        Re: "We could never ever put our customers at risk"

        VM is NOT enough. It's one client per box, or these attacks can get through. (On current hardware.)

        1. phuzz Silver badge

          Re: "We could never ever put our customers at risk"

          I've not heard of an attack that can get access to data from a separate CPU in a multi-CPU machine. Any links you can point me towards?

    2. Anonymous Coward
      Anonymous Coward

      Re: "We could never ever put our customers at risk"

      That they took an optimal approach to mitigation probably explains why Azure notably outperformed AWS and GCS on the CPU aspect of recent cloud benchmarks. That and the Hyoer-V hypervisor.

  2. MatthewSt

    Premature exposure

    'It is probable Microsoft has an equally strong story to tell for Azure, but when we asked for more details, the answer was: "At this time, Microsoft will not be commenting."'

    It might be because you spilled the beans and gave some sysadmins some very long days and nights! Don't think I'd be inclined to give you a story after that either!

  3. Anonymous Coward
    Anonymous Coward

    Video Links

    From https://myignite.techcommunity.microsoft.com/sessions/84202

    BRK2254 - Spectre/Meltdown: An Azure retrospective

    https://twitter.com/h0x0d/status/1190448255479336960 (1 of 4)

    https://twitter.com/h0x0d/status/1190448260332154880 (2 of 4)

    https://twitter.com/h0x0d/status/1190448262844571648 (3 of 4)

    https://twitter.com/h0x0d/status/1190448264610320385 (4 of 4)

  4. RM Myers

    but to date there have been few reports of successful and damaging attacks

    Few, or none? I don't remember reading about any successful or damaging attacks.

  5. mevets

    Alternate universe much?

    "The security of our customers is paramount. Accelerate the rollout."

    "We could never ever put our customers at risk and if we broke that promise, why would anyone trust us ever again? "

    How indeed! Are you sure they weren't a comedy duo?

  6. VinceLortho
    FAIL

    Deja Vu

    A long while ago I wrote a paper for Intel engineers addressing a similar problem with improper coding regarding speculative instruction caching. Evidently, none of the silly buggers read it.

    I was once proud of my career in IT. Now I tell my grandchildren I played piano in a bordello.

  7. Zippy´s Sausage Factory
    Facepalm

    "how the computer industry came together to address this new class of vulnerability, and specifically how Azure responded".

    So, without the actual details of how they responded, I'm going to revert to my default position of someone just shrugged and said "meh, it'll never happen".

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like