Slashdot Log In
Amazon's EC2 Having Problems With Spam and Malware
Posted by
ScuttleMonkey
on Wed Jul 02, 2008 02:14 PM
from the you-kids-get-off-my-cloud dept.
from the you-kids-get-off-my-cloud dept.
jamie pointed out a story about the recent problems Amazon's EC2 service has been having with malware and spam. "EC2 space is now actively blocked by Outblaze, and has been listed by Spamhaus in their PBL list [...] However as Seth Breidbart noted in the comments, 'note that Amazon will terminate the instance. That means that the spammer just creates another instance, which gets a new IP address, and continues spamming.' True enough -- as described, instance termination simply isn't good enough."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Death Penalty (Score:5, Funny)
While I'm against the death penalty, I might be willing to consider it for spammers.
Re:Death Penalty (Score:5, Funny)
Now thats the REAL instance termination we need!
Not spam filters, SPAMMER filters!
Parent
Re: (Score:3, Interesting)
I don't see why the government doesn't prosecute the companies that have their products spammed. They are the absolute root of all this. Without them, there wouldn't be any placebos to sell so that they can hire more spammers. There's got to be SOME way to get to them.
Re:Death Penalty (Score:4, Insightful)
Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.
Parent
Re: (Score:3, Informative)
Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.
Actually, it's more like going after gun dealers who don't go through standard procedures before selling a gun. If you held the companies responsible, believe me there would be more initiative to prevent spamming. That, and it's not tough to nail companies that ship a large amount of placebos and claim them to do things they don't.
Re: (Score:3, Interesting)
Re:Death Penalty (Score:5, Insightful)
As someone who has been involved with both sides of an affiliate program myself, I tend not to agree with your assessment. The company I worked for did an amazingly good job of keeping spammers from promoting our products. We had people on this continuously. These aren't random folks, they're people who we are paying (i.e. have an ongoing legal business relationship with) to bring customers to us. You can damn well bet it's our responsibility to make sure they act appropriately: they're our employees (claims of "independent contractor" notwithstanding).
I think that a reasonable legal framework for applying pressure to companies that benefit from spammers is warranted. I would have been glad to work under such a framework myself. Really, there's no excuse.
Cheers.
Parent
Terms of Service (Score:5, Insightful)
They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.
Re:Terms of Service (Score:5, Insightful)
And what if the credit card in question is stolen?
Parent
Re:Terms of Service (Score:5, Insightful)
Then the owner will actually notice that his/her card is stolen, and finally go over the bill with a fine-toothed comb, disputing charges as they go.
Nothing is lost.
Parent
Re:Terms of Service (Score:5, Insightful)
That's something of an extreme approach. Not exactly the sort of behaviour that would endear a company to its customers.
If your EC2 account got hacked (which may happen if its worth the effort), you would end up hacked, billed, and having quite possibly a hell of a fight to get your cash back.
Parent
Re: (Score:3, Funny)
No problem. EC2 is unhackable!
ppppppffffffffffffffft. Sorry, I couldn't say that with a straight face.Re: (Score:2)
Unless they use a fake visa (debit or check card) in which case the consumer has absolutely zero recourse.
Banks and credit unions are not held the same dispute structure as credit card companies (since the legislation concerning charge disputes was drafted and instituted during a more consumer-friendly congress than was legislation created for debit and check cards).
Re: (Score:2)
Perhaps.
Though (as you say) there's no law in place to enforce good behavior on the bank's part, I've always had decent luck with my bank when it came to sorting out weirdness with debit cards.
Re:Terms of Service (Score:5, Insightful)
Actually, both Visa and MasterCard hold banks to the same "Zero Fraud Guarantee" policy for Debit Cards as they do Credit Cards.
In fact, if you search Visa.com for their Consumer Credit Card and Consumer Debit Card pages, you'll see that the Zero Fraud Policy link on both takes you to the same page.
They require that banks put provisional funds back into your account within 5 days of the dispute being made. Most banks do this the same day. I bank at BoA and they do it within hours.
The policy extends to charges incurred as a side-effect of the fraud, like overdrafts.
It does not apply to pin-based transactions, but there are no pin-based transactions on the web anyhow.
This makes sense if you think about it and it has nothing to do with Congress. Many people are transitioning away from cash. I hardly EVER carry cash. I use my Debit card for everything. And Visa has a vested interest in seeing this continue. A HUGE interest.
Besides, there is no difference between "Banks and credit unions" and "credit card companies."
Visa doesn't give out credit. They don't even give out credit-cards. They just provide a clearinghouse network. On their end, a Debit Card transaction (non-pin-based) looks identical to a CC transaction.
Of course, none of this applies if your debit card doesn't carry a Visa or MC logo. But if that's the case, you're not using it online, anyway.
Parent
Re:Terms of Service (Score:5, Interesting)
Then amazon needs to do a much better job of determining who their clients really are, and there are quite a few fairly reliable ways of doing so.
Nothing is perfect, but it can be made very hard.
Parent
Re: (Score:3, Insightful)
Re:Terms of Service (Score:5, Informative)
Actually, tough luck to vendor who allowed the fraudulent transaction. The credit card companies themselves typically have very little (any?) responsibilities when it comes to fraudulent transactions. It's entirely up to the vendor to do the proper verification prior to billing a transaction, as far as I know.
The problem is that these small fraudulent transactions are typically more expensive to track down than they are to write off. If someone racks up a $1,000 bill on the ec2 cloud with a stolen card, the credit card company isn't out a dime, and the vendor (in this case Amazon) isn't likely to spend much time finding and prosecuting whoever is using the stolen card because it's expensive and time consuming to do so. Sure, maybe some ip addresses will be blocked and cards added to blacklists (temporarily?) but that doesn't stop the next guy from doing the same with a new stolen card.
Parent
Re:Terms of Service (Score:4, Insightful)
Parent
Re:Terms of Service (Score:5, Interesting)
Parent
Re: (Score:2, Insightful)
Crap idea. Small start-ups use this kind of service instead of a dedicated server in a server farm. Compare costs and you'll see why.
What is small for emails? One small project I set up has over 5000 users, when their reports are ready they get notified, when something changes, they get notified.
6 months of spam will generate a hell of a lot more than thr $5-10k bond.
There are far better ways to stop spamming. Follow the money all the way to the companies selling the drugs, watches, or whatever. Someone is
Re: (Score:2)
As a web app developer, that's potentially a dealbreaker for me. Who determines what spam is?
According to the five-ten DNSBL, anything that's sent w/o a closed loop opt in is spam. So they block all sorts of ips the rest of us might think of as legitimate, like "microsoft, multiple public radio newsletters (from different radio stations in different states), travel notifications and newsletters from Expedia and Hotw
Terminate accounts not instances? (Score:5, Insightful)
Why aren't Amazon terminating the accounts of offenders, and blacklisting whatever payment method they're using? It's a paid service, it's not like spammers can register for new accounts as much as they like, they're going to run out of credit card numbers (well, assuming their activities aren't more nefarious than mere spam).
It's not in Amazon's interests to have EC2 blacklisted.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
I agree of course, but how exactly do you go about identifying these people so that they don't open another account? Credit card numbers? PayPal accounts? Last names? What?
Nothing prevents Joe Spammer from creating a second account as Joe Spammer Thornton III a day after the first one is turned off. The capabilities of Amazon's cloud are too juicy to pass up.
Re: (Score:2)
Amazon has billing information for those accounts. Money changes hands. So, require that the name and address given to Amazon when setting up the account match the billing name and address of the credit card used to pay for the services. Most mail-order and on-line merchants do that already, and won't ship except to the billing name/address. Then block known pre-paid debit card numbers and one-time card numbers. Not perfect, but it should knock down 90% of the problems and make it a lot harder for a crimina
Re: (Score:2, Insightful)
I think you're missing the point. If the offenders have stolen credit cards, they likely also have the correct name and address to go along with them. Adding electronic verification does absolutely nothing to solve the problem, unless we start requiring matching state issued IDs or SSNs to our cards. The obvious problem with that is now we're allowing even more private, extremely sensitive data to flow across the internet.
It's a difficult problem to solve; certainly more so than simply requiring matching
Re:Terminate accounts not instances? (Score:5, Interesting)
There's actually a solution to that, but it involves slowing the process down. Just don't activate the account once the information's entered. Instead, send a physical letter to the credit-card billing address. You can require a form to be signed and returned, or just include an activation code in the letter that has to be entered to turn the account on. That should make it infeasible to use 99% of stolen cards. It introduces a few days of delay between requesting the account and getting it, but IMO if you intend to use the account for any length of time a few days shouldn't be an issue and if you don't then you're likely exactly the kind of person this is intended to filter out.
Parent
Re: (Score:2, Informative)
I remember when PayPal did that when I opened my account back in 2000. I'm not sure if they still do that, but it certainly is a solution. It adds significant time, infrastructure (auto mailing facilities, employees, machines, etc) -- which all boil down to cost. I didn't like waiting the 4 or 5 days for my secret pin to arrive. On the other hand, if I applied for an account and either my pin didn't work or I never received it and I had to go through it multiple times, I'd probably start looking at othe
Re: (Score:2)
Yes.
Re: (Score:2, Offtopic)
You cannot "fine" anyone for anything. Amazon does not create the law which can punish users.
What Amazon can do is have a "service reactivation fee" that is required to be paid to reinstate suspended accounts.
Sheesh, seems like a match made in heaven (Score:5, Interesting)
Somebody finally solved the ????? = Profit equation. What's everyone getting so worked up about?
Re:Sheesh, seems like a match made in heaven (Score:5, Insightful)
Parent
How is this different from any colo... (Score:2)
or virtual/private server company? And what would happen to the spammers? Account cancelled, so they'd just find another colo/host, or use one of many stolen credit cards to register another account with same host, under a different name. How is this any different?
Re: (Score:3, Insightful)
The hoster terminates the client and won't sign him up again. Amazon could easily do he same but doesn't. Instead the only terminate the instance.
I'd RTFA but... (Score:4, Funny)
Re:I'd RTFA but... (Score:5, Informative)
My thoughts exactly. Luckily, Brian Krebs at the Washington Post wrote about this in his Security Fix blog [washingtonpost.com].
Parent
Re: (Score:2)
Terminate the account! (Score:3, Interesting)
Once they have the name of the instance, they also know who launched it -- after all, they are billing someone.
I like the suggestion to charge a large fee to the credit card they have on file, but what about simply banning the account in question?
Honeynet Project (Score:2, Interesting)
Amazon needs to offer a spamfree block (Score:2)
Offer a spamfree block of IPs using their persistent IP offering, and let people put in a large deposit when getting an IP there. If they spam, confiscate the deposit. Use the interest on the deposit to offset the cost of triaging abuse complaints.
Although if mail is incidental to your business you can probably just host a relay offsite.
It's a problem? Really? (Score:3, Funny)
Here is a wild idea... WILD.. Off the hook insanity....
Just block ALL of EC2 from being able to send out anything on port 25 and 587.
Problem solved. Last time I checked EC2 has a lot more interesting uses than running mail server software.
Re: (Score:2)
How about improving the monitoring? (Score:2, Insightful)
Spammers and abusers tend to have distinctive patterns and this what Amazon should be paying attention to. Ie. some guy using a US credit card, logging to his instance from eastern Europe and sending a zillion emails messages the second day after sign up should raise some doubts. Manual inspection of suspic
Re:So what is EC2? (Score:5, Informative)
Parent
Re: (Score:2, Funny)
No, it's apparently something in the Amazon. I guess Brazilian deforestation is a major contributor to the global increase in salted canned pig meat.
Re:So what is EC2? (Score:4, Funny)
Wikipedia says it's the north eastern corner of the city of London, roughly. I don't get the article, either.
Parent
Re: (Score:3, Insightful)
EV certificates cannot sign mail, only server to server communication. E-mail signing certificates cost about $30, and require absolutely no proof of identity, just existence. This is no barrier whatsoever.
Re: (Score:3, Informative)
Why do all the antispam nazi's solutions ignore the collateral damage to innocent by standers? "They should educate themselves" "they should switch providers" they scream. Black lists do nothing but break the system. I'd rather get all the spam than have important mail bounce. Just last week I had a mission critical email bounce because of some lame blacklist. This email not getting to its recipient would have basically ruined my life. Its a good thing I have the ability to send mail from more than once source.
If you formulate your mails the same way you usually formulate your posts on Slashdot [slashdot.org], I'm really not surprised, Mr. Fr0sti P1ss GNNA.
PBL is the wrong blacklist to whine about (Score:5, Informative)
Ah, the PBL. That's where your argument falls to pieces.
From http://www.spamhaus.org/pbl/index.lasso [spamhaus.org] :
PBL IP address ranges are added and maintained by each network participating in the PBL project, working in conjunction with the Spamhaus PBL team, to help apply their outbound email policies.
So, your ISP told Spamhaus that mail shouldn't be coming from the range your IP address is in. Not Spamhaus making a trite, petty and vindictive block for the fun of it. Not some blacklist deciding in error to block a whole /24 full of static addresses with REAL rDNS records for most of it because they found a couple of zombied machines with vaguely generic-looking PTRs in it. This is a case of the people you pay for connectivity telling Spamhaus that the rest of the world should not accept mail from your IP address or others near it until further notice - they're being good neighbours, and are to be applauded.
If you have a static address you can poke a hole in the PBL for it pretty easily - *you* can provide that further notice:
A feature of the PBL is the elimination of 'false positives' with a server-identifying and automatic removal mechanism for single IP addresses. This allows end users with static IP addresses within a larger dynamic pool, and legitimate mail server operators, to assert that in their opinion their IP addresses are a trustworthy source of email and to automatically remove (suppress) their IP addresses from the PBL database. Safeguards are built in to prevent abuse of this facility by spammers (and particularly by automated bots).
Do your research. The PBL is pretty damn useful, and you probably qualify for free use. If you have an unfiltered postmaster address on your domain (you do, don't you?) the smart thing would be to start blocking with it but make sure the rejection contains something like "Rejected: $IP_ADDRESS listed in Spamhaus PBL ( http://lookup-urlip_address/ [lookup-urlipaddress] ) - please contact postmaster@whineyblacklisthater.org for assistance if required" - you'll find that the "false-positives" for it are almost invariably from people who don't know what the PBL is and want to do their own thing, regardless of the practicalities the rest of the world has to face. Why should I or anyone else accept mail from somewhere your own ISP or their upstream provider has said I shouldn't?
Parent