Google makes shielded virtual machines its default cloudy option

As Azure adds Intel's much-probed SGX to its confidential zone

Google has made its Shielded VMs the default option in its cloud.

The web giant introduced Shielded VMs as an option in mid-2018. The virtual machines use a virtual trusted platform module (vTPM) and UEFI firmware to make it hard to sneak in malicious firmware, dud drivers, rootkits and other nasties that could mess up a VM as it launches.

Now Google has made shielded VMs the default in its IaaS service, provided you’re running newer cuts of CentOS, CoreOS, Debian, RHEL, SUSE Linux, Ubuntu and Windows Server. Google has also put shielded VMs beneath Cloud SQL, GKE, Kaggle and its Managed Service for Microsoft Active Directory.

Migration of UEFI-based VMs from your premises to o Shielded VMs in GCE has also been enabled.

On the very same day, Microsoft also announced an advance of its confidential computing cloud with the release of a new DCsv2-series VM that uses Intel’s Software Guard Extensions (Intel SGX) to keep data encrypted even while being processed.

In theory, SGX means data is not visible to an OS, hypervisor or even a user.

In practice it’s had holes kicked in it by attacks labelled PlunderVolt and Membuster, while the Intel-teasing boffins at Austria’s University of Graz have also had their wicked ways with the tech. SGX also helped to mount the LVI attack that continued the lame legacy of Meltdown and Spectre.

Intel’s patched SGX over the years and Azure has a sound security record.

Microsoft’s scored comment about the goodness of its confidential computing offering from secure messaging service Signal, which has plenty to lose if Microsoft has mucked up. ®