Tenable's 2025 Cloud Security Risk Report has found that there's sensitive data being held in 9% of publicly accessible cloud storage, and that 97% of this data is classified as restricted or confidential.

The data includes API keys, access keys, encryption keys, and tokens, as well as traditional usernames and passwords.

More than half of organizations (54%) store at least one secret directly in Amazon Web Services (AWS) Elastic Container Service (ECS) task definitions, for example, making for an easy line of attack. And alarmingly, said Tenable, 3.5% of all AWS Elastic Compute Cloud (EC2) instances contain secrets in user data.

And using Identity Providers (IdPs) alone doesn't fix this: while 83% of AWS organizations are using IdPs effectively to manage their cloud identities, they are still being exposed to identity-based threats, thanks to overly permissive defaults, excessive entitlements, and standing permissions.

Things weren't much better among organizations using Google Cloud Platform (GCP) Cloud Run, with 52% of users exposed, or for Microsoft Azure Logic Apps workflows, where the figure was 31%.

Researchers described what they called a 'toxic cloud trilogy' – a workload that is publicly exposed, critically vulnerable, and highly privileged. And while over the last year, the number of organizations in this situation has fallen from 38% to 29%, this still makes for a significant and common risk.

"Despite the security incidents we have witnessed over the past few years, organizations continue to leave critical cloud assets, from sensitive data to secrets, exposed through avoidable misconfigurations," said Ari Eitan, director of cloud security research at Tenable.

"The path for attackers is often simple: exploit public access, steal embedded secrets, or abuse overprivileged identities."

There are a variety of reasons for the secrets being exposed, said Tenable. Two big causes are misconfigured access settings and overly permissive policies. Another is privilege elevation by developers, which may be intended for short-term use but then forgotten, eventually becoming permanent.

Other contributing factors include flawed permission structures caused by inconsistent access policies or overlapping roles, inadequate – often manual – monitoring, and even the mistaken belief that obscure storage bucket URLs provide sufficient protection. And one major reason that secrets are being exposed may simply be that organizations aren't aware of the sensitivity level of the data.

"To close these gaps, security teams need full visibility across their environments and the ability to prioritize and automate remediation before threats escalate," said Eitan. "The cloud demands continuous, proactive risk management, and not reactive patchwork."

Amazon Web Services (AWS) customers will soon be able to book time slots at physical locations to connect their storage devices and upload data to the cloud.

Data can be uploaded to any AWS endpoint, including Amazon S3, Amazon Elastic File System (Amazon EFS), or others, using a high throughput connection of up to up to 400Gbps.

Each AWS Data Transfer Terminal will house a patch panel, fiber optic cable and a PC for monitoring data transfer jobs, the hyperscaler revealed. Terminals will be charged by the hour, with no per GB charge for the data transfer if the data remains in the same continent.

The first two Data Transfer Terminals are already up and running in Los Angeles and New York, with plans to launch more globally.

So far, the company is only listing charges for US-to-US transfers - $300 per hour - and US-to-EU at $500.

"On your reserved date and time, visit the location and confirm access with the building reception. You’re escorted by building staff to the floor and your reserved room of the Data Transfer Terminal location," said Channy Yun, principal developer advocate for AWS Cloud.

"Don’t be surprised if there are no AWS signs in the building or room. This is for security reasons to keep your work location as secret as possible."

The company said the terminals will significantly cut the time it takes to upload large amounts of data, meaning ingested data can be processed within minutes.

Customers can then analyze large datasets using Amazon Athena, train and run machine learning models with ingested data using SageMaker, or build scalable applications using Amazon EC2.

"After the data is uploaded to AWS, you can use the extensive suite of AWS services to generate value from your data and accelerate innovation," Yun commented.

"You can also bring your AWS Snowball devices to the location for upload and retain the device for continued use and not rely on traditional shipping methods."

Suggested use cases include video production data for processing in the media and entertainment industry, training data for Advanced Driver Assistance Systems (ADAS) in the automotive industry, or migrating legacy data in the financial services industry.

The hyperscaler also noted the service could help support uploads of equipment sensor data in the industrial and agricultural sectors.

"You can upload large datasets from fleets of vehicles operating and collecting data in metro areas for training machine learning models, digital audio and video files from content creators for media processing workloads, and mapping or imagery data from local government organizations for geographic analysis," said Yun.

Hackers are redoubling their attempt to break into business applications and cloud infrastructure, according to an analysis of incidents investigated by one security operations center (SOC).

Managed detection and response company Expel said that ‘identity threats’’ – attempts to break into email or other business applications - accounted for 64% of all incidents its SOC investigated, and that these had increased in volume by 144% over 2022.

Analysis from the firm showed a 72% increase in cloud infrastructure incidents across the last year, with stolen or leaked credentials responsible for two-in-five incidents.

The identity threat incidents were either unauthorized email logins (accounting for 60%) or authentications to identity platforms, like Microsoft Entra ID (which was formerly known as Azure Active Directory), Okta, Ping, and Duo.

Organizations saw an average of eight identity-based incidents over the year, although one nonprofit organization was targeted 255 times, Expel said in its report.

Two-thirds of these incidents involved malicious logins from suspicious infrastructure, such as unexpected hosting providers or proxies. Expel said it had seen a shift toward using more proxies and VPNs by attackers, and that this would continue until organizations consistently put “effective roadblocks” in place like multifactor authentication (MFA).

Expel said the increasing volume of these attacks was a direct result of more phishing platforms becoming available, which make it easier to create convincing login pages that can trick unsuspecting users into handing over passwords.

The firm said one particular group known as “The Com” was responsible for the largest number of targeted identity attacks its SOC investigated this year. This group primarily targeted Okta and Microsoft accounts, attempting to abuse password policies.

These attackers will call into IT help desks, pretending to be a member of staff locked out of their account and asking for passwords be reset. If requests via the helpdesk or self-service system are successful, the attacker sends MFA pushes to the real user. If the user accepts the MFA push, the attacker gains access to the account.

Expel said it classifies any evidence of a compromised user password as an identity incident, even if the login is then blocked by MFA.

“Many authentication blocking methods are but a small speed bump for attackers and require our analysts to take further action to prevent potentially successful attempts,” the firm said. 

“In fact, we’ve seen many instances when an attacker tried to login, was blocked by conditional access based on geolocation or MFA, and immediately switched to a bypass method, like a VPN or legacy protocol, resulting in successful login.”.

As such, organizations should thoroughly investigate any situation where users could have unknowingly compromised their passwords, the report said.

Expel said cloud infrastructure incidents were also accelerating, with stolen or leaked cloud credentials the biggest risk. These stolen credentials allow attackers to maintain persistent access to a cloud environment with the permissions connected to that identity or role.

Expel’s definition of an incident is an attacker gaining at least control plane or data plane access in the cloud environment.

The company said 96% of the incidents it detected or responded to occurred in AWS, while the other 4% were split evenly between GCP and Azure. That’s even though about half of its cloud customers use AWS, around 33% use Azure, and roughly 17% use GCP.

It said this heavy skew towards AWS is likely the result of more AWS security research and auditing tools available for attackers to abuse.

Exposed credentials were the top cause of cloud infrastructure incidents seen by Expel: these can give attackers access to the cloud control plane either through a framework or command-line utility. These secrets can be exposed through accidental upload to repositories, vulnerability exploitation, or information stealing malware.

The secrets users accidentally uploaded to digital repositories were the ones most exposed. All in all, stolen or leaked credentials accounted for over 40% of the cloud incidents it investigated.

Server-side request forgery attacks, which trick a public-facing web application into exposing sensitive information, was the second most common incident type used to trick AWS EC2 instances into exposing secrets. The third most frequent incident type resulted from use of default credentials (19%), which were most often abused by attackers scanning the Internet to deploy crypto miners.

Expel said that to keep cloud infrastructure safe companies should ensure they are following strong identity management practices, regularly removing unnecessary keys and rotating access keys – and insisting on MFA for access to cloud consoles.

However, it acknowledged that “sometimes people forget to change passwords, no matter how often they’re told.” In this case, it said, companies should maintain an inventory of Internet-facing assets and ensure the availability of web-access logging. This data aids in investigating and identifying the root cause of an incident, it said.

Whether it’s attempts to compromise email accounts or business applications, or gain access to cloud infrastructure, there are key lessons to learn, Expel said.

Be careful with passwords and other credentials, watch out for odd log-in behavior, and use MFA where you can.

Nvidia has announced a series of big tech partnerships this week, including collaborations with AWS and Adobe to provide cloud infrastructure and hardware for training proprietary AI models.

AWS will work with Nvidia to build scalable infrastructure with the express purpose of training large language models (LLMs) for use in generative AI systems. The cloud giant’s P5 elastic compute instances run on Nvidia hardware and provide support for the largest and most complex LLMs.

Adobe and Nvidia have also announced that they will co-develop a series of generative AI models for eventual integration within Adobe’s Creative Cloud suite.

Adobe Firefly is one such model that will focus on image and text effect generation. Being trained on Adobe's own licensed content, or copyright-free material, it's tipped to be an ideal solution for businesses looking to shield themselves from potential plagiarism claims.

Why is Nvidia big tech's go-to partner on AI?

Core to the growing number of big tech agreements Nvidia has secured is its growing dominance in the AI ecosystem.

This was bolstered with the announcement of the Nvidia DGX cloud platform, an AI supercomputing service that lets enterprise customers rent Nvidia’s supercomputing servers and workstations through a web interface.

Oracle Cloud Infrastructure will be the first to host Nvidia DGX Cloud and Nvidia has already announced that other high-profile cloud services providers such as Microsoft Azure and Google Cloud will follow suit, with the tipped for adoption next quarter.

Nvidia’s long-running expertise in designing graphics processing units (GPUs) has also made it particularly sought after for the development of AI models.

The firm has said that GPUs are up to 20 times more energy-efficient than central processing units (CPUs) for AI work, and that its H100 GPU is up to 300 times more efficient for training LLMs than CPUs.

Microsoft’s AI supercomputer, which the firm has revealed it made in time to train both OpenAI’s GPT-3.5 and GPT-4 models, makes heavy use of the H100 for computing power.

It's not clear if this is the same ‘AI supercomputer’ Nvdia and Microsoft announced in November, or whether the firms have partnered again on a longer-term project. In either case, Nvidia has a clear role in Microsoft’s plans for AI going forward.

“Nvidia's status in AI is certainly due in large part to the performance of its GPUs, but this performance is not just a result of hardware,” James Sanders, principal analyst cloud and infrastructure at CCS Insight, told ITPro.

“Nvidia's CUDA software framework provides a common platform that allows developers and users to run the same software across different models and successive generations of GPUs, making generational upgrades seamless, as well as making original development substantially easier."

Sanders added that while Nvidia does have competition in the GPU market from AMD and Intel, it benefits from its competitors' imperfect software support. On rival cards, adaptations need to be made in order to for them to support critical models such as Stable Diffusion.

At the enterprise level, Nvidia faces competition from purpose-built AI accelerators, which are technically faster than Nvidia's GPUs, but require "significant effort to adapt as existing models", Sanders said.

These accelerators also can't be found in easily accessible hardware like consumer-grade laptops, which means developers have to solely rely on cloud platforms if they want to experiment.

“You hear a lot about LLMs at the moment, but there are also a lot of other AI models such as computer vision and NLPs, and these need to be supported at both the hardware and software layer," said Bola Rotibi, chief of enterprise research at CCS Insight, to ITPro. "Nvidia is providing that, as well as choice over processors as well as AWS’ Graviton 3 processors.”

Does Nvidia face competition in this space?

AMD is a major competitor for Nvidia in the GPU market, occupying a 12% share compared to Nvidia’s 17% in Q4 2022, according to Statista.

But while the firm’s Instinct line of GPUs is specifically targeted for deep learning, it has not announced as expansive a foray into generative AI as its competitor.

“The reason why Nvidia is actively trying to use AI technology even for applications that can be done without using AI is that Nvidia has installed a large-scale inference accelerator in the GPU,” David Wang, SVP engineering for Radeon at AMD, told 4Gamer in an interview that was machine-translated from Japanese.

“In order to make effective use of it, it seems that they are working on a theme that needs to mobilise many inference accelerators. That’s their GPU strategy, which is great, but I don’t think we should have the same strategy,” he added.

Without similar investments in AI infrastructure, it is possible that AMD will miss its chance to establish a similar footing in the market as Nvidia.

In addition to its hardware pedigree, Nvidia’s growing cloud ecosystem has already attracted a number of high-profile media partners including Getty Images, Shutterstock, and financial services firm Morningstar.

With a rapidly-expanding number of partners and customers, it may already be too late for competitors to catch up.

Given AMD’s reputation as a more affordable GPU alternative, the company could become a mainstay for those looking to train open source LLMs.

However, some notable open source AI companies such as Hugging Face have already announced plans to use AWS’ AI ecosystem, which has already put Nvidia ahead in this space.

Nvidia could still find itself facing competition from new challengers in the market. Raja Koduri, formerly Intel’s VP of architecture, graphics, and software (IAGS) division, has announced his resignation in order to start a firm that will challenge Nvidia’s GPU dominance in both gaming and generative AI.

Intel itself has also released a range of hardware that it has designated for AI workloads, such as its high-performance Max Series chip family.

But, Nvidia's focus on diversifying its product offering for enterprise and cloud more broadly will likely see it continue to dominate for some time.

"Immediately, the most visible part of this is its acquisition of Mellanox in 2020 for $7 billion, which provided the company advanced networking capabilities – as AI workloads (like other enterprise workloads) spread across multiple networked servers, high-speed, low-latency networking is essential for high performance,” said Sanders.

An outage at an Amazon Web Services (AWS) data centre has knocked offline a number of major services.

Among the affected services are cryptocurrency exchange platform Coinbase, payment platforms Venmo and CashApp, streaming services including Disney+, Netflix, and Epic Games, dating app Tinder, investment service Robinhood, as well as the McDonald’s app.

Amazon products such as its Echo Dot AI voice assistant, Ring security camera, Kindle ebooks, and music streaming service Amazon Music.

The outage, which began at around 3:20pm GMT, has been attributed to application programming interface (API) and console issues with an AWS data centre in North Virginia known as US-EAST-1.

At 4:26pm GMT, AWS acknowledged the issues on its status page, adding that it had identified the root cause of the issue and is “actively working towards recovery”.

The tech giant’s Support team has also advised customers to attempt to switch access to the US-WEST-2 console, which is based in Northern California:

The extent of the outage can be attributed to AWS popularity – as the largest cloud infrastructure vendor in the world, AWS controls 32% of the global market as of the third quarter of 2021. In comparison, rivals Microsoft Azure and Google Cloud control a 21% and 8% market share, respectively.

US-EAST-1 had previously been the culprit of other significant AWS outages. On 28 February 2017, it took down a number of popular websites and applications, including Slack, Trello, Netflix, Reddit, Quora, and others. Caused by a mistyped command, the issue lasted more than two hours.

On 25 November 2020, the Northern Virginia data centre caused an even longer outage, knocking offline a number of services, such as 1Password, Acorns, Adobe Spark, Anchor, Autodesk, Capital Gazette, Coinbase, DataCamp, Getaround, Glassdoor, Flickr, iRobot, The Philadelphia Inquirer, Pocket, RadioLab, Roku, RSS Podcasting, Tampa Bay Times, Vonage, The Washington Post, and WNYC.

The issue was attributed to the data centre’s servers “exceeding the maximum number of threads allowed by an operating system configuration”.

So far, AWS hasn’t announced the cause of today’s outage, which is still ongoing at the time of writing.

The new head of Amazon Web Services, Adam Selipsky, made his Re:Invent debut as CEO on Tuesday with a glut of announcements for compute, networking and data.

The former Tableau boss returned to the cloud giant earlier in the year to take over from Andy Jassy, who has now taken over the top job of its parent company, Amazon.

Jassy's Re:Invent keynotes were notoriously long and always full of new products. Selipsky gave a much shorter presentation than his predecessor, but there was no skimping on the announcements.

It started with a new in-house processor - Graviton 3 - which will power new Amazon Ec2 C7g instances. Available in preview, EC2 C7g instances will provide the best price performance in Amazon EC2 for compute-intensive workloads such as high-performance computing, gaming, video encoding, and CPU-based machine learning inference, according to Selipsky.

What's more, these instances are the first in the cloud to feature cutting edge DDR5 memory technology, which AWS said will provide 50% more bandwidth than DDR4 memory. C7g instances will provide 20% higher networking bandwidth compared to previous generation C6g instances based on the Graviton 2 processors.

Selipsky also unveiled Inf1 Instances for EC2, also in preview, which is a Trainium-based AWS service. AWS Trainium is the second machine learning chip built by AWS that is optimised for high-performance deep learning training. Selipsky said the Trn1 instances will deliver "best price performance" for training deep learning models in the cloud, which includes use cases such as natural language processing and image recognition. They support up to 16 Trainium accelerators, up to 800 Gbps of EFA networking throughput and ultra-high-speed intra-instance connectivity for the fastest ML training in Amazon EC2.

Moving on to data, Selipsky announced AWS Mainframe Modernization, a new platform for mainframe migration. This will allow customers to shift and modernise their on-premises mainframe workloads to a managed and highly available runtime environment on AWS. This service currently supports two main migration patterns: re-platforming and automated refactoring.

The announcements also included 5G, which is becoming increasingly prominent at AWS events. On Tuesday it was a preview of AWS Private 5G, a new managed service that helps enterprises set up and scale private 5G mobile networks in their facilities in just days. It takes just a few clicks in an AWS console for customers to specify where they want to build a mobile network and the network capacity needed for their devices. From there AWS delivers and maintains the small cell radio units, servers, 5G core and radio access network (RAN) software, and subscriber identity modules (SIM cards) required to set up a private 5G network and connect devices.

AWS has announced that it’s retiring its Elastic Compute Cloud (EC2) Classic network after 15 years in operation, with customers given until 2022 to migrate their services to its successor.

EC2-Classic, widely considered a foundational cloud computing technology, was launched in 2006 as a virtual computing environment that organisations could use to host scalable applications. These ‘instances’ provided layers of security, different hardware configurations, as well as pre-configured templates.

This technology was eclipsed with the launch of AWS' Virtual Private Cloud (VPC) platform in 2009, which serve as virtual networks of isolated EC2 instances. It was again followed by the launch of Virtual Private Clouds for Everyone in 2013.

AWS has now decided to retire EC2-Classic, giving customers two years to complete all migrations away from the older technology and towards VPC.

“EC2-Classic has served us well, but we’re going to give it a gold watch and a well-deserved sendoff,” said chief evangelist for AWS, Jeff Barr, in an in-depth blog post.

“We are not planning to disrupt any workloads and we are giving you plenty of lead time so that you can plan, test, and perform your migration. In addition to this blog post, we have tools, documentation, and people that are all designed to help.”

When is AWS retiring EC2-Classic?

AWS has begun notifying all current EC2-Classic customers through their account teams, and will soon begin issuing notices in the Personal Health Dashboard.

From 30 October 2021, AWS will disable EC2-Classic in Regions for AWS accounts that have no active EC2-Classic resources in the Region. The firm will also stop selling one-year and three-year Reserved Instances for EC2-Classic.

Then, from 15 August 2022, AWS expects all migrations to be complete, with no remaining EC2-Classic resources present in any AWS account.

All AWS accounts created after 4 December 2013 were already VPC-only, unless EC2-Classic was enabled as a result of a support request, meaning the change is likely only to affect longstanding AWS customers.

How to migrate from EC2-Classic to VPC

Although AWS will notify customers they will need to migrate, there are several steps that businesses running EC2-Classic instances will need to take. To prepare, ahead of any migration, the firm has put together guidance available on the AWS site.

To fully migrate, customers need to find, examine, and migrate several resources. These comprise running or stopped EC2 instances, running or stopped RDS database instances, Elastic IP addresses, Classic Load Balances, Redshift clusters, Elastic Beanstalk environments, EMR clusters, AWS Data Pipelines, ElastiCache clusters, Reserved Instances, Spot Requests, and Capacity Reservations.

Customers may also need to create, or recreate if deleted, the default VPC for their account. In some cases, they’ll need to be able to modify the existing resources, but in other cases, customers will need to create new and equivalent resources in VPC.

The task may seem daunting, but AWS has launched the EC2 Classic Resource Finder script so customers can find all EC2-Classic resources in their accounts. This can either be run directly in a single AWS account or can be used against all accounts within an organisation.

Customers, at this stage, can use a variety of migration tools that AWS has developed including AWS Application Migration Service, Support Automation Workflow, IP Address Migration, and Class Load Balancers.

Comprehensive support is available through Barr’s post hosted on the AWS site, including a more in-depth overview of each of these migration tools, as well as guidance for updating instance types as businesses move from EC2-Classic to VPC.

Amazon Web Services (AWS) has announced that Apple's macOS operating system will be available on its cloud service for developers.

Amazon EC2 Mac instances for macOS and will run on Mac mini computers and will support developers building apps for the iPhone, iPad, Mac, Apple Watch, Apple TV and Safari.

This is the first big announcement to come from AWS re: Invent, which started on Monday as a three-week virtual conference. The cloud giant previously offered EC2 instances for Windows and Linux, but has now opened it up to macOS which is a popular system for many developers.

What's more, AWS has also said that cloud support for devices with Apple's new M1 chip is planned for 2021.

AWS will make Apple computers available in its data centres, starting with the Mac Mini, which will help developers to create and test apps remotely rather than maintain their own devices. It's thought this could help Apple to further pivot towards building more of its own software and services.

"You can provision new instances in minutes, giving you the ability to quickly and cost-effectively build code for multiple targets without having to own and operate your own hardware," said Jeff Barr, AWS chief evangelist. "You pay only for what you use, and you get to benefit from the elasticity, scalability, security, and reliability provided by EC2."

CCS Insight senior VP Nick McQuire suggested that the growing partnership between AWS and Apple will likely be the headline trend at re: Invent 2020.

"Not only will this move help to improve the cost, security and efficiency of building applications, what is most interesting is the potential for 5G capabilities down the line as both parties have been pioneering 5G solutions to the enterprise in 2020," he told IT Pro.

"When you consider the direction mobile phones and applications are taking, with low latency and high throughput becoming the norm in support of technologies like VR, AR, edge computing and media streaming, for example, this AWS and Apple tie-up has formidable potential."

Amazon Web Services (AWS) today joined its rivals in releasing a blockchain service, half a year after its CEO cited a lack of "practical use cases" for the technology.

Basing its blockchain-as-a-service (BaaS) on Ethereum and Hyperledger Fabric networks, AWS wants to give developers the tools they need to develop their own blockchain apps.

"Some of the people that I talk to see blockchains as the foundation of a new monetary system and a way to facilitate international payments," said AWS vice president and chief evangelist Jeff Barr in a blog post. "Others see blockchains as a distributed ledger and immutable data source that can be applied to logistics, supply chain, land registration, crowdfunding, and other use cases.

"Either way, it is clear that there are a lot of intriguing possibilities and we are working to help our customers use this technology more effectively."

AWS's Blockchain Templates allows users to quickly launch either a public or private Ethereum network, or a private Hyperledger Fabric network, with the templates creating and configuring all the AWS resources needed based on the cloud giant's pay-as-you-go pricing structure.

The platform has been adopted by a number of companies in sectors such as healthcare and finance, including mobile operator T-Mobile and Guidewire, an insurance platform provider.

T-Mobile is building an identity and authentication platform with Sawtooth, a technology from the Intel Hyperledger project, while Guidewire is using blockchain to auto-approve insurance claims and trigger payments.

AWS's push into the blockchain market sees it follow in the footsteps of rivals including IBM, Microsoft, Oracle and SAP, which have all deployed versions of this technology.

Oracle, for example, launched its Blockchain Cloud Service at its OpenWorld conference in October last year to boost the competitiveness of its cloud services against IBM and Microsoft's packages.

However, AWS's decision to follow suit marks a significant shift in strategy, given that its CEO, Andy Jassy, dismissed the potential of blockchain at AWS's re:Invent 2017 conference in November.

"We don't yet see a lot of practical use cases for using blockchain that are much broader than using a distributed ledger," he said in a press Q&A. "We don't build technology because we think it's cool, we build it when we think it's the best way of solving a customer's problem. Ledger capabilities to me are much more limited than they should be."

Cloud Pro has approached AWS for comment on why it has shifted direction on blockchain.

Picture: Bigstock

A serious design flaw reportedly present in all Intel's CPUs made in the last 10 years could leave devices vulnerable to hackers, requiring an operating system (OS) update in order to fix it.

The flaw allegedly affects all systems running Intel x86 chips and is present across all popular operating systems, including Windows, Linux, and macOS, but is currently under embargo, meaning the full details of the bug are yet to be officially announced.

The bug allows normal user programs, such as database applications and JavaScript in web browsers, to distinguish some of the layout or contents of protected kernel memory areas of the chips, according to The Register, which uncovered the vulnerability.

However, the major problem for users is that a patch to the flaw will actually cause significant declines in performance for the affected machines, the publication said. These slow-downs could impact performance by as much as 30%, depending on the task and the processor model, but they're reportedly still being benchmarked.

The full details of the bug are expected to be revealed later this month. Microsoft is also expected to publicly introduce the necessary changes to its Windows operating system in an upcoming Patch Tuesday this month, after seeding them to beta testers running fast-ring Windows Insider builds in November and December.

A software developer who runs a popular Tumblr called Python Sweetness, has blogged about the potential trouble this flaw could cause once it's made official. They warned that "from everything I've seen, including the vendors involved, many fireworks and much drama is likely" when the embargo lifts.

"In the worst case the software fix causes huge slowdowns in typical workloads. There are hints the attack impacts common virtualisation environments including Amazon EC2 and Google Compute Engine, and additional hints the exact attack may involve a new variant of Rowhammer," they explained.

"I would not be surprised if we start 2018 with the release of the mother of all hypervisor privilege escalation bugs, or something similarly systematic as to drive so much urgency, and the presence of so many interesting names on the patch set's CC list."

An Intel spokesperson said that "many different vendors and operating systems" are vulnerable to the bug.

They added: "Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits.

"Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied."

Picture: Bigstock

Amazon Web Services (AWS) is to roll out two further Electric Cloud Compute (EC2) instance types, as well as a new service that will allow end users to analyse disparate application data.

The new offerings were announced by Werner Vogels, chief technology officer of AWS, during his keynote presentation at the cloud services firm's Re:Invent conference in Las Vegas.Many of you asked us for these instance types and I really hope you put them to good use. The first of the two new instances is designed for AWS customers that use databases or analytics tools that require a lot of memory, whereas the second is aimed at people who use storage-heavy analytics systems.

The high memory EC2 instance boasts 240 GB of RAM and 2 x 120GB solid-state storage (SSD) drives.

Meanwhile, the high storage instance type features 160 GB of RAM that sits on 24 2TB HD and provides users with 48TB of data.

During the presentation, Vogels told delegates the new instance types would allow them to build "amazing new applications".

"Many of you asked us for these instance types [and] I really hope you will put them to good use," he added.

Shortly afterwards, Vogels lifted the lid on another new service the firm is rolling out, called AWS Data Pipeline.

"[This is] a data driven workflow service that helps you move data through several processing steps to the destination [where you want it]," he explained.

The service allows users to set rules that feed data from various sources into analytics engines before moving it on to another repository, such as Amazon's Simple Storage Service (S3).

"This service allows you to create schedules...and it is easy to integrate with existing AWS data sources and [it] also connects easily with third party analytics tools," Vogels added.

Data analytics has been a popular theme at the conference so far, with the cloud giant using the first day of Re:Invent to announce the imminent release of its cloud-based data warehousing service RedShift.

We're nearly mid-way through August and officially into what we call the 'silly season' in tech land. Most vendors tend to hold off launching products or putting out many announcements, meaning the PR industry has to get creative.

However, this week has seen quite a lot of action. Especially in the patent space.

Put it on my Tab. Oh wait, I don't have one.

A German court has ruled in favour of Apple temporarily banning sales of the Samsung Galaxy Tab 10.1. Apple argues that the Tab 10.1 infringes on its design rights by imitating the iPad.

Although we found the Tab 10.1 disappointing and some of the elements in Samsung's TouchWiz smartphone and tablet interface look very Cupertino-ish, we have little sympathy for Apple's position.

Then again, rumours of looters returning stolen Galaxy Tabs in favour of nicking iPads instead may give some tenuous credence to Apple's legal claims.

Cloudy with a chance of thunder.

The cloud is the future of computing! Or so claim many in the IT industry. Unfortunately the cloud can disappear at the drop of a hat such as when a lightning storm takes out some of Amazon's servers knocking out its EC2 cloud computing service.

Of course, nothing works flawlessly all the time, but the cloud needs to be more robust if we're all going to rely on it for our everyday computing. We eagerly anticipate the arrival of this hypothetical more resilient cloud.

Bridge over troubled Blue Waters

IBM, once the master of supercomputers that could play chess and enslave humanity for use as batteries, has given up on an ambitious 20,000 square foot computer. The Blue Waters supercomputer would've been used for complex simulations, such as those of the weather.

It's a bit of a climbdown for Big Blue at a time when we're marking the 30th anniversary of the IBM PC and the 100th anniversary of the company itself . Up next: Heinz gives up making beans because it's too difficult?

Amazon is putting its EC2 cloud up for auction, to sell off its unused capacity.

Amazon Web Services (AWS) has announced the launch of a new paid-for model called Spot Instances, which enables prospective customers to bid for capacity in Amazon's cloud.

The Spot Price changes depending on supply and demand but as long as the customer's bid exceeds that price the space is theirs.

Peter De Santis, general manger of Amazon EC2, said in a statement: "As customers continued to expand their use of AWS, they started asking if additional pools of capacity were available, even if only for a few hours at a time."

"Some customers were looking to reduce costs in exchange for being flexible as to when they run their application; others told us they were willing to pay more when they had urgent, high volume needs."

He added: "Because of the dynamic nature of supply and demand in the Amazon EC2 environment, we developed Spot Instances to let customers take advantage of our unused capacity while specifying a price they are willing to pay."

The company claimed this new way of purchasing capacity and compute power is well suited to flexible start-stop applications such as data processing, web crawling and video rendering.

Spot Instances run the same software images and are the same sizes as both On-Demand and Reserved Instances. This means customers can move between the different purchasing options as and when they chose.

Microsoft has today thrown its hat into the enterprise cloud computing market by unveiling a technology preview of its new utility computing platform called Windows Azure.

Going head-to-head with the likes of Amazon's EC2 cloud computing offering, Azure is an underlying services platform for developers looking to host, run and integrate their own applications and services in a Microsoft-based externally hosted (cloud) environment. Furthermore, it will allow developers to easily maintaining application and information links between the cloud environment and the traditional enterprise client, server and data centre structure.

Azure will be hosted by Microsoft in its own worldwide network of data centres and sold as a service to users and developers. Applications and services written to run on Azure will also be hosted by Microsoft to take advantage of both utility processing and shared on-demand storage.

"The notions of virtualisation and utility computing were pioneered in the 60s, yet it is only now that it is really being pushed forward as the future of enterprise computing and the most viable delivery mechanisms for enterprise computing architecture," said Ray Ozzie, Microsoft's chief software architect, speaking during the keynote at Microsoft's Professional Developer Conference in Los Angeles.

"We need to begin laying groundwork with model-based deployment, new approaches to storage, new application design methods, adoption of parallel computing and more," he added.

Ozzie explained that the Azure Services Platform will allow developers to build applications that will work seamlessly in the cloud and with client or local server-side applications using existing tools and languages such as the .NET Framework and Visual Studio, as well as open source development environments and tools as well as making use of common internet standards including HTTP, ATOM and REST.

The Azure Services platform comprises the main Windows Azure underlying system for hosting, managing, scaling and running applications, SQL Services for database reporting, processing and services, .NET Services for implementation of .NET Framework concepts, Live Services for integration between the cloud and client-side devices and applications, mobile devices and end user web sites.

Finally, SharePoint Services and Dynamics CRM Services will provide business content, collaboration and rapid solution development for key day-to-day business accounting and operational needs, putting Azure in direct competition with the likes of NetSuite, Salesforce, Oracle and SAP.

Microsoft also revealed details of a new project called "Atlanta" - a System Centre portal to allow IT managers to administer Azure and on-premise infrastructure as one.

While in its technology preview stage, which is effectively an early beta release, Azure will be free but will be offered without warranty, service level agreements or guarantees that applications written for it now will work on the final version.

However, analysts attending the event were cautious in their outlook following the Azure announcement.

"Microsoft has finally put some meat on the bones of its cloud computing intentions. It has the potential for being a coherent strategy but it is too early to call it just yet. It relies a lot on educating a market that is still in the quagmires of SOA," said Bola Rotibi, principal analyst at Macehiter Ward-Dutton.

Microsoft has come into enterprise cloud computing with the sector still in its infancy, but with several competitors already situ with products that have moved beyond the initial beta stage, making the early days of Azure difficult to say the least.

"Nobody should assume that Microsoft will be the only company that aims to bring cloud services based on Microsoft Windows to market. A slew of Microsoft partners are able to offer cloud services and will continue to do so, even after Microsoft expands it portfolio," said David Mitchell, senior vice president of IT research at analyst firm Ovum.

"We should assume that there will be strong competition in the market and that customers need to make sure that they are genuinely able to move between suppliers, to help unlock the promises that cloud offers."

Click here for more PDC news.