VmiCVS: Cloud Vulnerability Scanner

Every service that runs in cloud systems comes with its own set of vulnerabilities. It is important to detect and assess those vulnerabilities to provide seamless and secure service to the users. Various scanners such as Port scanner, Network scanner, Web application security scanner, Database security scanner, Host based vulnerability scanner etc provide security assessment. But these scanners use methods that an attacker uses to attack in order to expose the vulnerabilities. As a result, application ecosystem might get disturbed and hard-to-attack vulnerabilities might left undetected. A yet another set of scanners check version of the service through protocol level messages in order to determine the vulnerabilities applicable to that particular service version. With this approach, certain vulnerabilities are not discovered when a particular software piece(example : glibc) is not directly exposed to the remote user. We propose a novel Cloud Vulnerability Scanner, VmiCVS (Virtual Machine Introspection based Cloud Vulnerability Scanner). It provides security assessment of vulnerabilities even if the software is hidden from remote user and without disturbing application ecosystem. It can be used by cloud provider to provide Vulnerability scanning-as-a-service where detected vulnerabilities are reported to tenant for additional incentives. We have evaluated our scanner by assessing the vulnerabilities of services such as sshd and hidden(from remote user) libraries such as glibc and libcrypto.