Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine (GCE)

guest · Jun 30, 2021

Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine
June 29, 2021
https://thehackernews.com/2021/06/unpatched-virtual-machine-takeover-bug.html

An unpatched security vulnerability affecting Google's Compute Engine platform could be abused by an attacker to take over virtual machines over the network.

"This is done by impersonating the metadata server from the targeted virtual machine's point of view," security researcher Imre Rad said in an analysis published Friday. "By mounting this exploit, the attacker can grant access to themselves over SSH (public key authentication) so then they can login as the root user."
Google Compute Engine (GCE) is an infrastructure-as-a-service (IaaS) component of Google Cloud Platform that enables users to create and launch virtual machines (VMs) on demand.
Click to expand...

In a potential real-world scenario, the aforementioned attack chain can be abused by an adversary to gain full access to a targeted virtual machine as it's being rebooted or over the internet in cases when the cloud platform's firewall is turned off.

Google was informed about the issue on Sept. 27, 2020, which has since acknowledged the report, describing it as a "nice catch," but has yet to roll out a patch, or provide a timeline for when the correction will be made available.

"Until the fix arrives, don't use DHCP or setup a host level firewall rule to ensure the DHCP communication comes from the metadata server (169.254.169.254)," Rad noted. "Block UDP/68 between VMs, so that only the metadata server could carry out DHCP."
Click to expand...

Log in or Sign up

Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine (GCE)

guest Guest

Log in or Sign up

Unpatched Virtual Machine Takeover Bug Affects Google Compute Engine (GCE)

guest Guest

Useful Searches