You are on page 1of 5

Volume 6, Issue 1, January 2016 ISSN: 2277 128X

International Journal of Advanced Research in
Computer Science and Software Engineering
Research Paper
Available online at:
Security Attacks on Cloud Computing With Possible Solution
Priyanka Chouhan, Rajendra Singh
Jaipur Engineering College, Kukas, Jaipur, Rajasthan,

Abstract— Cloud computing is an emerging technological paradigm that provides a flexible, scalable and reliable
infrastructure and services for organizations. Cloud data are stored and accessed in a remote server with the help of
services provided by cloud service providers. Some example of cloud service providers are Amazon, Google's
Application, IBM, etc., which provide facility for users to developing applications in cloud system environment and
allow to access them from any remote location. Services of cloud computing is based on sharing thus it is open for
attacker to attack on its security. The main thing that grabs the organizations to adapt the cloud computing
technology is cost reduction through optimized and efficient computing, but there are various vulnerabilities and
threads in cloud computing that affect its security. Providing security in such a system is a major concern as it uses
public network to transmit data to a remote server. Therefore the biggest problem of cloud computing system is its
security. In this paper we discussed different type of security issue related to cloud computing and some possible
solution for them.

Keywords—Cloud Computing, Security Attacks, DoS Attack, Malware Injection Attack, Side Channel Attack,
Authentication Attack, Man-in-The-Middle Attack

Today network security is very challenging task, as it is an integral part of network service. But due to rely on computer
network for secret and important file, security has become very important part of it. Network security becomes much
more difficult to control when the environment becomes as dynamic and demanding as cloud computing. Main aim of
cloud computing is to reduce the cost of using resources such as storage, processing power, services etc. These help users
to focus on their business without worry of resources. The evolution of cloud computing is from many different
technologies such as virtualization, grid computing, autonomic-computing, and some other technologies. New challenges
arise whenever a new technology comes. In general, cloud computer security identifies following main objectives:
1) Availability: The goal of availability for Cloud Computing systems is to ensure that data and services are always
available for its users at any time, at any place.
2) Confidentiality: The goal of confidentiality is to keep users data secret in the Cloud systems by making it
available only to eligible entities and no unauthorized access to data can be obtained.
3) Integrity: The goal of Data integrity in the Cloud system is to assure that data has not been altered in any way
while it is stored or while its transport over the network.
4) Authentication: The goal of authentication is to assure the identity of the entity involved in the communication.
5) Accountability: The goal of accountability is to assure that no entity can deny its participation in a data transfer
between them.

These security objectives require the employment of certain security mechanisms and services to be implemented. A
security mechanism can be defined as a process, or a device, which aimed to detect, or prevent, or recover from a security
attack. Security mechanisms like steganography, encryption, hashing etc. are commonly used in providing security to a
system. A Security Service can be identified as a processing or communication service aimed to enhances the security of
data and the information transfers of an entity. These services help in countering security attacks. Security services
usually employ one or more security mechanism to achieve its goals.

As the world is moving towards cloud computing, it become more sophisticated and attackers look to follow it. Some of
the potential attacks on cloud computing are:-

A. Denial of Service (DoS) attacks
In DoS attack, an attacker overloads the target cloud system with service requests so that it stop responding to any new
requests and hence made resources unavailable to its users. Some Cloud Security Alliance has identified that the cloud is
more vulnerable to DoS attacks, because it is used by so many users which makes it much more damaging. DOS attacks
are of many types,
© 2016, IJARCSSE All Rights Reserved Page | 92

and the attacker code starts to execute. this attack is the major representative of exploiting the service-to-cloud attack surface. the ability of a malicious instance to utilize side channels to learn information about co-resident instances. For this firewalls can be used to allow or deny traffic on the basis of access protocols. ping of death etc 3) An attacker can make HTTP request in large amount so that it can not be handle by the server for example HTTP DDOS attack. the attacker has to behave so as to make it a valid service to the Cloud system that it is some new service implementation instance among the valid instances. It can be very easy to gain secret information from a device so security against side channel attack in cloud computing should be provided Possible solutions against Side Channel attacks To prevent cloud from side channel attack we can use combination of virtual firewall appliance. 2) An attacker can make use of blank space (lacuna) that associated with various networking protocol to overload target resource. Side Channel Attacks An attacker attempts to compromise the cloud system by placing a malicious virtual machine in close proximity to a target cloud server system and then launching a side channel attack. Similar to switches routers have also some capability like ACL and rate-limiting which can be set manually to create rules and regulations. full functionality changes/reverse or blockings. Side channel attacks use two steps to attack. for example SYN floods. After DoS attack one can send all the traffic on attacked packet to a null interface or to a non existing interface. According to the case study of Amazon EC2 service it is possible for an attacker to instantiate new virtual machine to identified targeted virtual machine in cloud and extracts some confidential information. the attacker has to derive control over the victim’s data in the cloud. The Hypervisor is responsible for scheduling all the instance and services so we can make hypervisor to check file allocation table to validate and integrate an instance of customer. ports or IP addresses. so we can block traffic that are identify as unauthorized and allow traffic that are identify as authorized. Possible solutions against malware injection attacks In cloud computing system application run by the customer are considered with high efficiency and integrity. shape traffic. we need to deploy a hypervisor on the provider’s side. Other approach is that we can maintain the information of the platform type version that a customer user to access the cloud in first phase when a customer open an account and can use those information to check the validity of new instance of the customer. Today most of the switches have capability of rate-limiting on the basis of Access Control List that can provide automatic rate limiting. Evaluating cryptographic systems resilience to side-channel attacks is therefore important for secure system design. Cloud Malware Injection Attack In Cloud Malware Injection Attack an attacker tries to inject malicious service or virtual machine into the cloud. So to prevent cloud from malware injection attack we can combine the integrity with hardware or can use hardware for integrity purpose because for an attacker it is difficult to intrude in the IaaS level. this helps to reduce the effect of DoS attack. Then. Chouhan et al. But a virtual firewall prevents this attempt of placement of malicious virtual machine during a side channel attack. If the attacker succeeds in this. binding and can deeply inspect packets. B. In this type of attack attacker creates its own malicious service implementation module (SaaS or PaaS) or virtual machine instance (IaaS). fragment packet attack.. Possible solutions against DoS attacks For restricting DoS attack we can classify traffic on the basis of authorization. it may include data modifications. for example UDP floods. pp..VM CO-Residence and Placement i. bogus IP filtering. and try to add it to the Cloud system. the Cloud automatically redirects the requests of valid user to the malicious service implementation. The main scenario behind the Cloud Malware Injection attack is that an attacker transfers a malicious service instance into cloud so that it can achieve access to the service requests of the victim’s service. ICMP floods etc. According to classification. by using it we can determine the validity and integrity of new instance by comparing the current and previous instance. Here by confusion we mean that making relation between plain and cipher © 2016. In cloud system hypervisor is considered to be the most secure and sophisticated part of it whose security cannot be broken by any means. Application front end hardware can be used on networks in colligation with routers and switches which can analyze data packets as they enter into the network system to check their authority and priority so that flow of traffic can be controlled. Another approach is to use randomly encryption decryption (using concept of confusion diffusion) because it prevent second step extraction of side channel attack. C.. For this purpose. For this we can utilize a file allocation table (FAT) system. IJARCSSE All Rights Reserved Page | 93 . an attacker can often place his or her instance on the same physical machine as a target instance and VM Extraction i. International Journal of Advanced Research in Computer Science and Software Engineering 6(1). The purpose of cloud malware injection attack can be anything in which an attacker is interested.e.2016. XML DDOS attack etc.e. 92-96 1) An attacker can overload the target with large amount of junk data that consume the network bandwidth and resources. January . To achieve this. Side-channel attacks have emerged as a kind of effective security threat targeting system implementation of cryptographic algorithms.

will be provided with fake information which would lead to loss of credentials. retinal. what keys of keyboard the user has pressed 4) Replay Attacks: The replay attacks are also known as the reflection attacks. The message sender does not recognize that the receiver is an unknown attacker trying to access or modify the message before retransmitting to the receiver. IJARCSSE All Rights Reserved Page | 94 . and Security). virtual keyboards. in this case. This should prevent an attacker from checking sufficiently many passwords in a reasonable time. It is a way to attack challenge response user authentication mechanism. 6) Key Loggers: The key loggers are the software programs which monitors the user activities by recording each and every key pressed by the user. 5) Phishing Attacks: It is a web based attack in which the attacker redirects the user to the fake website to get passwords/ Pin Codes of the user. by diffusion we mean to dissipate the statistical structure of plaintext over the bulk of cipher text. The advantage of this method is that it is real and unique signature and cannot be stolen. It is not a completely matured method and it can be easily compromised and is time consuming also.e. pp. Availability. Today most of the services still use simple username and password type of knowledge-based authentication. Some type of MIM attacks are: 1) Address Resolution Protocol Communication (ARP): In the normal ARP communication. this measure is designed to prevent attackers from checking sufficiently many passwords in a reasonable time. the host PC will send a packet which has the source and destination IP address inside the packet and will broadcast it to all the devices connected to the network. site keys. etc. Some authentication attacks are: 1) Brute Force Attacks: In this type of attack.2016. The brute force attack is generally applied to crack the encrypted passwords where the passwords are saved in the form of encrypted text. all possible combinations of password apply to break the password. 3) Shoulder Surfing: Shoulder Surfing is an alternative name of “spying” in which the attacker spies the user’s movements to get his/her password. International Journal of Advanced Research in Computer Science and Software Engineering 6(1). The disadvantage is that it is costly and difficult to implement. signature verification are used to verify against the original specimen. the dictionary attack tries to match the password with most occurring words or words of daily life usage. 92-96 text more and more complex. Authentication Attacks Authentication is a weak point in cloud computing services which is frequently targeted by an attacker. D. Biometrics: Biometric is an image-based authentication system in which finger prints. 2) ARP Cache Poisoning: In ARP cache poisoning. In the process. how he enters the password i. The ARP protocol is not a secured protocol and the ARP cache doesn't have a foolproof mechanism which results in a big problem. speech. Man-In-The-Middle Cryptographic Attacks A man in the middle attack is one in which the attacker intercepts messages in a public key exchange and then retransmits them. face. As explained earlier this is a kind of online MIM attack where the attacker has created a fake website of your bank. 3) DNS Spoofing: The target. E. the attacker controls the entire communication. Thus. so when you visit your bank website you will be redirected to the website created by the attacker and then the attacker will gain all your credentials. iris. an account is locked for an hour after five unsuccessful attempts. January . © 2016.) that make it more difficult for popular phishing attacks. so that the two original parties still appear to be communicating with each other. The device which has the target IP address will only send the ARP reply with its MAC address in it and then communication takes place. 2) Dictionary Attack: This type of Attack is relatively faster than brute force attack. 4) Session Hijacking: In this once the session is established between the host PC and the web server the attacker can obtain certain parts of the session establishment which is done by capturing the cookies that were used for the session establishment. but some exception are financial institutions which are using various forms of secondary authentication (such as shared secret questions. Security against both front end and back end side of cloud computing architecture is provided by this combination and also provide RAS (Reliability. Account locking: Accounts are locked after a few unsuccessful login attempts (for example. The image is preprocessed first and then the classification of images is done. When we use randomly encryption decryption we mean that customer data or information encrypted through different encryption algorithm so attacker faces more difficulties to detect or extract cryptography key. Chouhan et al. Unlike checking all possibilities using brute force attack. In this type of attack the attacker observes the user.. the attacker would be sniffing onto the network by controlling the network switch to monitor the network traffic and spoof the ARP packets between the host and the destination PC and perform the MIM attack. Possible solutions against Authentication attacks Delayed response: Given a login-name/password pair the server provides a slightly delayed yes/no answer (say not faster than one answer per second).) Like the previous measure. the two original parties appear to communicate normally. substituting his own public key for the requested one.

Verification can be conducted by using public and private keys.” International Journal of © 2016. 75–80. J.: Cloud Computing: benefits. 459–469. [3] Stallings. REFERENCES [1] Buyya. Reiter. X.P. 2012. (2010).. with many client and server implementations.: Rfc 2828: Internet security glossary. pp. S. [7] Contractor. Gnanasekaran.. Elsevier. Q. Communications and Informatics. 2014 [16] Koushik. the server verifies the client and the client verifies the server to ensure legitimate communications are being exchanged. 2012. [4] Security in Cloud Computing Kazi Zunnurhain1. III.: Trust management framework for attenuation of application layer ddos attack in cloud computing.. As cloud computing is on the rise. U. ACM. Nanda. 2013.I. 2014. pp. Zulkernine. [13] Varadharajan. Y. pp. pp. R.: Characterizing hypervisor vulnerabilities in cloud computing servers. 2013 IEEE Sixth International Conference on. In: Proceedings of the 2013 international workshop on Security in cloud computing.. 2011 IEEE International Symposium on. V. M. A.. Vrbsky2 Department of Computer Science The University of Alabama . we can expect to see a lot of security incidents and new kinds of vulnerabilities around it within the decades to come. and Susan V. Shiva.2010.24-28 May 2010. Future Generation Computer Systems 30. 25–41 . 5533317searchabstractMIPRO. John Wiley & Sons.. S. In: Cloud Computing (CLOUD). “Security Issues in Cloud Computing and Countermeasures.” in Hardware-Oriented Security and Trust (HOST). elsewhere on the Internet. 2013. [14] Patel. “Cloud computing security issues and challenge”.2016. pp. M. 4/E.Luo and Y. H. ACM. V. A.M. M. S.. Lee. Springer. Thandapanii.K. Chouhan et al. Lots of research is going on to address the issues like cloud security...: Cloud computing: Principles and paradigms. “Algorithmic collision analysis for evaluating cryptographic systems and sidechannel attacks. International Journal of Advanced Research in Computer Science and Software Engineering 6(1). R.: An intrusion detection and prevention system in cloud computing: A systematic review. J. [11] Godfrey. Journal of Network and Computer Applications . virtualization and isolation of resources. M. 2013 [15] He. Fei. [8] Karnwal. also get the same certificate?  Is the certificate signed by a trusted CA? 3) By using mutual authentication. 2006.. 92-96 Possible solutions against Authentication attacks: 1) By using one time password because one time password is immune to MIM attacks. 3–10.R. Broberg.. Jamil and H. [2] Shirey. [12] Zhang... Abdullah. Hocenski Z. Side Channel Attacks. Patil. In: ICT and Critical Infrastructure: Proceedings of the 48th Annual Convention of Computer Society of India-Vol I. T. W.. Zaki. [17] Winkler. T. IJARCSSE All Rights Reserved Page | 95 . D. 2000. Pearson Education India.: Securing the Cloud: Cloud computer Security techniques and tactics.. risks and recommendations for information security. J. security issues arise. In: Trust Management VI.J. 467–471. Cyber Warfare and Digital Forensic (CyberSec).: A filter tree approach to protect cloud computing against xml ddos and http ddos attack. 201–208. Mohammadalian. [10] Perez-Botero. pp. 305–316. T. A. 2010 [6] Bedi. 116–126. Udzir. A. P. N. Ristenpart.: Cross-vm side channels and their use to extract private keys. Szefer. [18] Popovic K. pp. The concepts we have discussed here will help to build a strong architecture for security in the field of cloud computation..: Securing cloud infrastructure against co-resident dos attacks using game theoretic defense mechanisms.B. Z. and especially due to its enormous attraction to organized criminals.: Open security system for cloud architecture. In: Proceedings of the 2012 ACM conference on Computer and communications security. ACM.. pp. D. In this paper we discuss Denial of Service (DoS) attacks.: A server-side solution to cache-based side-channel attacks in the cloud. 219–224. A. IEEE.. The Internet Society. A. In: Cyber Security. With mutual authentication. S. Springer. Goscinski.. Celestino J´uNior. Cloud Malware Injection Attack. January . Tupakula. 2012. 87. Springer. [9] Manavi. In: Proceedings of the International Conference on Advances in Computing. pp. R. 463–469. Authentication Attacks and Man-In-The-Middle Cryptographic Attacks of cloud computing and also provide some possible solutions. 163–170. Taghavi.. Chomsiri. Patel. Juels.. CONCLUSION With the rapid increase in the adoption of cloud computing by many organizations. data protection. IEEE. 2) By forensic analysis of MIM attacks  IP address of the server  Is the certificate self signed?  Do other clients. Tan. IEEE. Journal of Network and Computer Applications 36(1). D. 2013.. 2011 [5] Catteddu.: Cryptography and Network Security. the initial trust is only confirmed by one way verification between the client and the server. 2011. vol.: Improving cloud network security using the tree-rule firewall. 2012 International Conference on.: Hierarchical secure virtualization model for cloud. pp. K. Bakhtiyari.. pp 344..: Counteracting security attacks in virtual machines in the cloud using property based attestation. 2012. Springer. Cloud security issues are active area of research and experimentation. In: Intelligent Informatics. D. S. 2013. 2010 Proceedings of the 33rd International Convention . [19] D.S.

Singh and M. Zunnurhain and S. 2008. 145–156.” International Journal of Engineering and Innovative Technology (IJEIT). Indianapolis. April 2011. 92-96 Engineering Science and Technology. September 2011 [23] H. In 4th International Conference on Wireless Communications. pp.wikipedia. Xi'an.pcworld. IJARCSSE All Rights Reserved Page | 96 . Tripathi and A. November 2010. J.. Yang. “Cloud Computing Security Considerations Interface. J. “Analysis on Cloud-Based Security Vulnerability Assessment. China. 2672-2676. pages 1–5. Liang. C. 2008 © 2016. Haataja and P. International Journal of Advanced Research in Computer Science and Software Engineering 6(1). 4. P. and Y.” 2011 IEEE International Conference on Signal Processing. pp. pp. [25] A. Jan. Mishra. Muhammad Sharif and Waqas Haider.490-494. H. Communications and Computing. s_attack/ [22] A.idg. Vol. World Applied Sciences Journal. [28] Mudassar Raza. [21] Researchers Demo Cloud Security Issue With Amazon AWS Attack. Oct.” 2nd IEEE International Conference on Cloud Computing Technology and Science. Networking and Mobile Computing.2016. M. Chen. vol. [24] B.” IEEE International Conference on E-Business Citeseer. January . no. pp. http://www. [29] Man-in-the-middle attack http://en. Practical Man-in-the-Middle Attacks Against Bluetooth Secure Simple Pairing. Shrivastava. Vrbsky. “Security Attacks and Solutions in Clouds. pp. 439-444. 2010. vol.” in Proceedings of the 1st international conference on cloud computing. “A Survey of Password Attacks and Comparative Analysis on Methods for Secure Authentication”. 4. 1. Zunnurhain and S. 2. Sevak. SISY 2008. 2013. 3 No. December 2010. A study of password authentication method against observing attacks. K. p. October 2011. “Overview of attacks on cloud computing. Vrbsky. WiCOM’08. 2012. 6 International Symposium on Intelligent Systems and Informatics. “Security attacks and solutions in clouds.” International Journal of Engineering and Advanced Technology (IJEAT). 183. and S. [27] [30] K. Toivanen. Muhammad Iqbal. 2012 [26] K. “Security against side channel attack in cloud computing. Chouhan et al. vol. no. 19. [20] K. 2. Li.