A survey on security issues and solutions at different layers of Cloud computing <s> Vulnerabilities in virtualization/multi tenancy <s> Attackers and defenders of computer systems both strive to gain complete control over the system. To maximize their control, both attackers and defenders have migrated to low-level, operating system code. In this paper, we assume the perspective of the attacker, who is trying to run malicious software and avoid detection. By assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits. We evaluate a new type of malicious software that gains qualitatively more control over a system. This new type of malware, which we call a virtual-machine based rootkit (VMBR), installs a virtual-machine monitor underneath an existing operating system and hoists the original operating system into a virtual machine. Virtual-machine based rootkits are hard to detect and remove because their state cannot be accessed by software running in the target system. Further, VMBRs support general-purpose malicious services by allowing such services to run in a separate operating system that is protected from the target system. We evaluate this new threat by implementing two proof-of-concept VMBRs. We use our proof-of-concept VMBRs to subvert Windows XP and Linux target systems, and we implement four example malicious services using the VMBR platform. Last, we use what we learn from our proof-of-concept VMBRs to explore ways to defend against this new threat. We discuss possible ways to detect and prevent VMBRs, and we implement a defense strategy suitable for protecting systems against this threat. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Vulnerabilities in virtualization/multi tenancy <s> Virtual machine (VM) introspection is a powerful technique for determining the specific aspects of guest VM execution from outside the VM. Unfortunately, existing introspection solutions share a common questionable assumption. This assumption is embodied in the expectation that original kernel data structures are respected by the untrusted guest and thus can be directly used to bridge the well-known semantic gap. In this paper, we assume the perspective of the attacker, and exploit this questionable assumption to subvert VM introspection. In particular, we present an attack called DKSM (Direct Kernel Structure Manipulation), and show that it can effectively foil existing VM introspection solutions into providing false information. By assuming this perspective, we hope to better understand the challenges and opportunities for the development of future reliable VM introspection solutions that are not vulnerable to the proposed attack. <s> BIB002 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Vulnerabilities in virtualization/multi tenancy <s> Cloud computing is a way to increase the capacity or add capabilities dynamically without investing in new infrastructure, training new personnel, or licensing new software. It extends Information Technology's (IT) existing capabilities. In the last few years, cloud computing has grown from being a promising business concept to one of the fast growing segments of the IT industry. But as more and more information on individuals and companies are placed in the cloud, concerns are beginning to grow about just how safe an environment it is. Despite of all the hype surrounding the cloud, enterprise customers are still reluctant to deploy their business in the cloud. Security is one of the major issues which reduces the growth of cloud computing and complications with data privacy and data protection continue to plague the market. The advent of an advanced model should not negotiate with the required functionalities and capabilities present in the current model. A new model targeting at improving features of an existing model must not risk or threaten other important features of the current model. The architecture of cloud poses such a threat to the security of the existing technologies when deployed in a cloud environment. Cloud service users need to be vigilant in understanding the risks of data breaches in this new environment. In this paper, a survey of the different security risks that pose a threat to the cloud is presented. This paper is a survey more specific to the different security issues that has emanated due to the nature of the service delivery models of a cloud computing system. <s> BIB003
Virtualization/multi-tenancy serves as the basis for Cloud computing architecture. There are mainly three types of virtualization used: OS level virtualization, application based virtualization, and Hypervisor based virtualization. In OS level virtualization, multiple guest OSs are running on a hosting OS that has visibility and control on each guest OS. In such types of configuration, an attacker can get control on the entire guest OSs by compromising the host OS. In application based virtualization, virtualization is enabled on the top layer of the host OS. In this type of configuration, each VM has its guest OS and related applications. Application based virtualization also suffers from the same vulnerability as in OS based vulnerabilities. Hypervisor or virtual machine monitor (VMM) is just like code embedded to host OS. Such code may contain native errors. This code is available at boot time of the host OS to control multiple guest OSs. If the hypervisor is compromised, then the entire controlled guest OSs can be compromised. Vulnerabilities in virtualization or hypervisor allows an attacker to perform cross-VM side-channel attacks and DoS attacks. For instance, a malformed code in Microsoft's Hyper-V run by an authenticated user in one of the VM caused a DoS attack [63] . Cloud providers thrive to maintain a maximum level of isolation between Virtual machine (VM) instances including isolation between inter-user processes. By compromising the lower layer hypervisor, an attacker can gain control over installed VMs. BLUEPILL  , SubVirt BIB001 , and DKSM BIB002 are all examples of attacks on the virtual layer. Through these attacks, hackers can modify the installed hypervisor and gain control over the host. Another event is a vulnerability found in the memory management of Microsoft virtual PC. This resulted in user programs running in the guest OS having read/write access to bypass security mechanisms like Data Execution Prevention (DEP), Safe Structured Error Handling (SafeSEH), and Address Space Layout Randomization (ASLR) BIB003 .