[Incident Handling and Response Process] Alice is a disgruntled employee. She decided to acquire critical information from her organization for…

The scenario describes a side-channel attack. This type of attack exploits information leaked from the physical implementation of a system rather than from a logical flaw in its software or algorithms. In this case, Alice's malicious virtual machine (VM) is co-resident with the victim's VM on the same physical host. By monitoring the state of a shared physical resource—the processor cache—Alice can infer sensitive data being processed by the victim VM, such as cryptographic keys. This technique of observing physical side effects (e.g., cache access times) to steal secrets is the defining characteristic of a cache-based side-channel attack.

B. Service hijacking: This involves the unauthorized control of a network service or an established user session, which is not occurring in the described scenario.
C. SQL injection attack: This is a web application vulnerability where an attacker injects malicious SQL queries into an input field to manipulate a backend database.
D. Man-in-the-cloud attack: This attack involves compromising a user's cloud synchronization account to intercept or manipulate data, which is different from attacking the underlying virtualization hardware.

1. Ristenpart

T.

Tromer

E.

Shacham

H.

& Savage

S. (2009). Hey

You

Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds. In Proceedings of the 16th ACM conference on Computer and communications security (CCS '09). Association for Computing Machinery

New York

NY

USA

199–212. Section 4

"Cross-VM Side Channels

" specifically discusses and demonstrates attacks where a malicious VM can extract information from a victim VM on the same physical machine by observing contention on the L2 processor cache. (DOI: https://doi.org/10.1145/1653662.1653687)

2. Yarom

Y.

& Falkner

K. (2014). FLUSH+RELOAD: A High Resolution

Low Noise

L3 Cache Side-Channel Attack. In 23rd USENIX Security Symposium (USENIX Security 14). USENIX Association

San Diego

CA

719–734. This paper details a specific and powerful cache side-channel attack mechanism that can be used in cross-VM scenarios to extract cryptographic keys by monitoring shared cache lines

as described in the question.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology. Lecture 15 Notes

"Side-Channel Attacks." The lecture notes define side-channel attacks as those that "exploit physical properties of the implementation" and explicitly list "Cache hits/misses" as a channel for such attacks. (Available at: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/mit6858f14lec15/)