2

We host several dedicated servers and VPS instances containing sensitive data with 3rd party hosting providers. We understand we have to trust the providers as they have full control of the hardware, root on the VPS hosts and IPMI access to the dedicated servers. We mitigate the risk by encrypting the disks and installing our own builds from scratch.

However assuming the threat is a malicious admin attempting to;

  1. gain once off unauthorised access to the data stored on disk
  2. install a backdoor to continually monitor server activities and data

What vulnerabilities exist in a VPS that could not be so easily exploited with a dedicated server?

Michelle
  • 153
  • 5
  • 1
    I think in either scenario you will have issues, but with a VPS an admin could take a "snapshot" of it while it is running via the hypervizor and then analyze that offline, which would be more difficult with a physical server – user2813274 Oct 27 '14 at 18:18
  • If the admin has root access, it doesn't make much difference. – Question Overflow Oct 28 '14 at 02:13

1 Answers1

3

With a VPS, the virtualization layer allows malicious admins to take a complete snapshot of the server (storage and RAM together) and inspect it at will; the nature of the snapshot is that you would not notice it. The equivalent in a dedicated server would entail one of the following:

  • Switching off the server, take a complete copy of the disk, reboot.
  • Install spying hardware directly within the machine (e.g. to make inspection of RAM).
  • Add some spying software in the operating system (again from direct access to the disk on the rebooted machine).

All these imply at least a shutdown/reboot, that you may notice -- unless the spying hardware had been there since day 1, of course.

Disk encryption won't actually help you much. Either the machine can reboot alone -- in which case a snapshot of the disk would be perfectly able to boot in, say, a VM; or you have to type in a decryption password whenever your server boots, which is both inconvenient, and vulnerable to eavesdropping from the malicious admin.

All of this requires taking some explicit actions that may not go unnoticed. A motivated attacker won't be deterred, and will plan a phony "reboot for electrical maintenance" to get your machine down for some minutes without you panicking. What dedicated hardware protects you against, as opposed to a VPS, is casual indelicacies from subaltern admins / interns.

(One may argue that having your own hardware also protects you against side-channel attacks from other customers at the same hosting service. Cross-VM side-channel attacks have been demonstrated in lab conditions, so whether they could be pulled off in the wild is an open question.)

Thomas Pornin
  • 326,555
  • 60
  • 792
  • 962