Could ‘Power Attacks’ Be Threatening Your Datacenter?
If hackers want to knock out server infrastructure, they might not need to target the machines with malware to corrupt their software stack. They might just use malware to rev up all the machines instead, causing circuit breakers to trip in the datacenter.
Between the data explosion and the mainstreaming of cloud services, datacenters have expanded to keep pace with demand. From 2008 to 2012, the number of servers in datacenters worldwide has increased from 24 million to over 35 million. As the server count soars, it is no longer unusual for power distribution systems to reach peak capacity. Upgrading these systems, however, is an expensive undertaking, commonly in hundreds of millions of dollars range. As a result, power oversubscription has evolved as a cost-effective way of managing power provisioning. Essentially, power oversubscription means there are more servers on the power infrastructure than it would be able to support if all the servers achieved maximum power consumption at the same time.
When carefully executed, the technique works well as servers rarely experience peak loads all at once under normal conditions. The approach is not foolproof, though. It leaves datacenters vulnerable to malicious workloads that could cause massive simultaneous power spikes on multiple servers – aka a power attack. As circuit breakers trip, unplanned power outages can occur. This is clearly an expensive and risky security vulnerability; a sudden outage affects both the owners and the users of the cloud services running on the datacenter.
In a recently-published research paper, Power Attack: An Increasing Threat to Data Centers, a team of computer scientists from the College of William and Mary and Ohio State University set out to demonstrate just how real of a threat these power attacks pose to security. To illustrate the feasibility of these techniques, the researchers devised a series of hardware experiments and a datacenter-level simulation. The experiments identify potential attack vectors for three mainstream cloud models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) environments.
The paper details the process by which the team is able to expose vulnerabilities in all three of these cloud computing services. Their initial results show that a power attack can boost power consumption of a target by over 30 percent in different environments.
Power distribution from the transformer to the server rack in a datacenter
"In PaaS, we demonstrate that an attacker can manipulate running workloads to significantly increase power consumption," the team writes. "In IaaS, we propose the concept of parasite attack and further show that VM migration can be exploited for helping to mount a power attack. In SaaS, we craft high power consumption requests that can trigger cache misses and intensive floating point operations to launch a power attack."
"Our experimental results and analysis show that power attacks will pose a serious threat to modern datacenters and should be taken into account while deploying new high-density servers and power management techniques," they advise.
For concerned parties, the paper offers detailed information regarding how various power management methods can affect a power attack and how mitigate such an attack. Specifically, three approaches are listed, including tracking the power consumption of individual incoming requests and taking appropriate action; a load balancing strategy called power balancing that relies on estimated power consumption; and finally, the deployment of per-server uninterruptible power suppliers, such that a shorter outage will not bring down the server.
The team plans to continue exposing the vulnerabilities inherent in power oversubscription as they explore more efficient and stealthy power attack vectors in different datacenter environments. And at the same time, they will come at the problem from the opposite direction by devising new methods and protocols to defeat such attacks.
The paper, Power Attack: An Increasing Threat to Data Centers, written by Zhang Xu, Haining Wang, Zichen Xu, and Xiaorui Wang, has been selected by the 21st Network and Distributed System Security Symposium (NDSS 2014), for presentation in San Diego, California, in February.
