Question

A security consultant is conducting a penetration test against a customer enterprise that comprises local hosts and cloud-based servers. The hosting service employs a multitenancy model with elastic provisioning to meet customer demand. The customer runs multiple virtualized servers on each provisioned cloud host.The security consultant is able to obtain multiple sets of administrator credentials without penetrating the customer network.

Which of the following is the MOST likely risk the tester exploited?

A. Data-at-rest encryption misconfiguration and repeated key usage
B. Offline attacks against the cloud security broker service
C. The ability to scrape data remnants in a multitenancy environment
D. VM escape attacks against the customer network hypervisors

Answer 1

The security consultant likely exploited the ability to scrape data remnants in a multitenancy environment, which can occur when a hosting service does not properly erase data from shared resources after reallocation.

Step-by-step explanation:

The security consultant's exploitation of administrator credentials without penetrating the network suggests the use of offline attacks against services interacting with the cloud infrastructure. Among the options provided, the most plausible risk that might be exploited is C. The ability to scrape data remnants in a multitenancy environment. This sort of attack involves accessing data left behind by other tenants in a shared environment due to inadequate data separation practices or insufficient cleanup processes.

In contrast, VM escape attacks require compromising the hypervisor from within a VM, which does not seem to be the case here as no penetration of the network was mentioned. Data-at-rest encryption misconfiguration might also be possible, but that usually involves active penetration to access the encrypted data. As the question specifies that no penetration was done, it points more towards leveraging data remnants that were not properly erased. Elastic provisioning implies that resources are dynamically allocated, so lingering data could be from previous customers whose resources were deallocated but not securely wiped.