Forgot your password?
typodupeerror
Spam Technology

Amazon's EC2 Having Problems With Spam and Malware 103

Posted by ScuttleMonkey
from the you-kids-get-off-my-cloud dept.
jamie pointed out a story about the recent problems Amazon's EC2 service has been having with malware and spam. "EC2 space is now actively blocked by Outblaze, and has been listed by Spamhaus in their PBL list [...] However as Seth Breidbart noted in the comments, 'note that Amazon will terminate the instance. That means that the spammer just creates another instance, which gets a new IP address, and continues spamming.' True enough -- as described, instance termination simply isn't good enough."
This discussion has been archived. No new comments can be posted.

Amazon's EC2 Having Problems With Spam and Malware

Comments Filter:
  • by Archangel Michael (180766) on Wednesday July 02, 2008 @03:23PM (#24035069) Journal

    While I'm against the death penalty, I might be willing to consider it for spammers.

    • by Anonymous Coward on Wednesday July 02, 2008 @03:33PM (#24035181)

      Now thats the REAL instance termination we need!

      Not spam filters, SPAMMER filters!

      • Re: (Score:3, Interesting)

        by Hojima (1228978)

        I don't see why the government doesn't prosecute the companies that have their products spammed. They are the absolute root of all this. Without them, there wouldn't be any placebos to sell so that they can hire more spammers. There's got to be SOME way to get to them.

        • Re:Death Penalty (Score:4, Insightful)

          by palegray.net (1195047) <philip DOT paradis AT palegray DOT net> on Wednesday July 02, 2008 @08:04PM (#24038215) Homepage Journal
          Because oftentimes it isn't those companies' fault. Say you have an affiliate program, or you rely on a third-party affiliate program management firm to provide compensation for those who promote your products. You can have strict terms for those people that warn against using spamming tactics to promote their affiliate sales, and you can terminate the ones who get caught, but you can't ever guarantee compliance en masse.

          Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.
          • Re: (Score:3, Informative)

            by Hojima (1228978)

            Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.

            Actually, it's more like going after gun dealers who don't go through standard procedures before selling a gun. If you held the companies responsible, believe me there would be more initiative to prevent spamming. That, and it's not tough to nail companies that ship a large amount of placebos and claim them to do things they don't.

            • Re: (Score:3, Interesting)

              by palegray.net (1195047)
              You're talking about two completely different things here. Your original idea was to hold the "final destination" companies responsible for the actions of spammers. This *will not work* in a great many cases for the reasons I cited in my previous post. Referencing your gun sales procedures analogy, it sounds like you've never run an affiliate program. Yes, you do your best to screen applicants to make sure they have a legitimate web presence before agreeing to allow them to market your products in exchange
          • Re:Death Penalty (Score:5, Insightful)

            by localman (111171) on Thursday July 03, 2008 @04:52AM (#24040749) Homepage

            As someone who has been involved with both sides of an affiliate program myself, I tend not to agree with your assessment. The company I worked for did an amazingly good job of keeping spammers from promoting our products. We had people on this continuously. These aren't random folks, they're people who we are paying (i.e. have an ongoing legal business relationship with) to bring customers to us. You can damn well bet it's our responsibility to make sure they act appropriately: they're our employees (claims of "independent contractor" notwithstanding).

            I think that a reasonable legal framework for applying pressure to companies that benefit from spammers is warranted. I would have been glad to work under such a framework myself. Really, there's no excuse.

            Cheers.

        • by VdG (633317)

          If that were done it would just become another extortion technique: cough up or I'll send SPAM in your name and the government will beat you up. Or just to hurt some company you've taken exception to.

          Sure: if you can trace a Spammer back to a customer then take action against that customer. But I suspect that would be easier said than done.

          • by Hojima (1228978)

            That's mostly a problem for illegitimate companies. If you take a look the bulk of the spam that makes the major revenue (i.e. online pharmacies), you'll see that they rely on consistent spamming. Legitimate companies do not, and therefore the government will go a bit easy if there is a spammer out there that tries that. Without funds to go on, the spammer only wastes resources. Besides, the government knows that legitimate companies get themselves hurt with spam since it damages their rep. and they usually

            • by VdG (633317)

              When SPAM first started it was from legitimate companies. And who says what's "legitimate"? Maybe a big company wouldn't want their name tarnished, but it might be more tempting for a smaller business. I can imagine some person running a business from home selling, say, macrame cooking pots over the internet deciding that a bit of spam was worthwhile as a cheap way to reach an international market. Or that spamming in the name of their rival down the road - or across the ocean - is tempting.

        • by giafly (926567)

          I don't see why the government doesn't prosecute the companies that have their products spammed.

          One reason is that much of the time the products are fake [spamdailynews.com].

          According to a recent [2005] study published in Britain, researchers purchased Viagra from several seemingly reputable Internet sources. They received what looked like branded Viagra, identically packaged like the real product. The sources of the pills were worldwide and included places like Thailand, India and Malta. The content of sildenafil was determ

    • Ah, spoken like someone's who's never lost a loved one or large sums of cash through human maliciousness, or been sexually assulted.
    • by Gazzonyx (982402)
      kill -9 spammer_init
      That's how I roll.
  • Terms of Service (Score:5, Insightful)

    by macx666 (194150) * on Wednesday July 02, 2008 @03:31PM (#24035149) Homepage

    They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.

    • by thermian (1267986) on Wednesday July 02, 2008 @03:33PM (#24035183)

      And what if the credit card in question is stolen?

      • by adolf (21054) <flodadolf@gmail.com> on Wednesday July 02, 2008 @03:34PM (#24035207) Journal

        Then the owner will actually notice that his/her card is stolen, and finally go over the bill with a fine-toothed comb, disputing charges as they go.

        Nothing is lost.

        • by thermian (1267986) on Wednesday July 02, 2008 @03:38PM (#24035251)

          That's something of an extreme approach. Not exactly the sort of behaviour that would endear a company to its customers.

          If your EC2 account got hacked (which may happen if its worth the effort), you would end up hacked, billed, and having quite possibly a hell of a fight to get your cash back.

        • by DittoBox (978894)

          Unless they use a fake visa (debit or check card) in which case the consumer has absolutely zero recourse.

          Banks and credit unions are not held the same dispute structure as credit card companies (since the legislation concerning charge disputes was drafted and instituted during a more consumer-friendly congress than was legislation created for debit and check cards).

          • by adolf (21054)

            Perhaps.

            Though (as you say) there's no law in place to enforce good behavior on the bank's part, I've always had decent luck with my bank when it came to sorting out weirdness with debit cards.

          • by encoderer (1060616) on Wednesday July 02, 2008 @06:45PM (#24037501)

            Actually, both Visa and MasterCard hold banks to the same "Zero Fraud Guarantee" policy for Debit Cards as they do Credit Cards.

            In fact, if you search Visa.com for their Consumer Credit Card and Consumer Debit Card pages, you'll see that the Zero Fraud Policy link on both takes you to the same page.

            They require that banks put provisional funds back into your account within 5 days of the dispute being made. Most banks do this the same day. I bank at BoA and they do it within hours.

            The policy extends to charges incurred as a side-effect of the fraud, like overdrafts.

            It does not apply to pin-based transactions, but there are no pin-based transactions on the web anyhow.

            This makes sense if you think about it and it has nothing to do with Congress. Many people are transitioning away from cash. I hardly EVER carry cash. I use my Debit card for everything. And Visa has a vested interest in seeing this continue. A HUGE interest.

            Besides, there is no difference between "Banks and credit unions" and "credit card companies."

            Visa doesn't give out credit. They don't even give out credit-cards. They just provide a clearinghouse network. On their end, a Debit Card transaction (non-pin-based) looks identical to a CC transaction.

            Of course, none of this applies if your debit card doesn't carry a Visa or MC logo. But if that's the case, you're not using it online, anyway.

            • Re: (Score:2, Interesting)

              by L0stm4n (322418)

              I lost my wallet once on a saturday and didn't notice until monday. I went out for more beer saturday night and my wallet fell out of my pocket ( best guess of what happened since the pants I was wearing always lost shit from the pocket when I sat down ) when I got in my friends car. Sunday I didn't go out so never looked for my wallet. Monday I looked and couldn't find it. Checked my bank of america online page and saw fraudulent charges. Mostly from local conveinence stores and wal-marts. I contacted BOA

        • Re: (Score:2, Informative)

          by mysidia (191772)

          They'll dispute all the illegal $1000 charges by EC2 which would cost Amazon a hefty chargeback fee for each transaction reversed.

          And possibly Amazon suffers other actions. Due to unjustifiable $1000 'surcharge' running afoul of consumer protection laws.

          You and I may think spam's bad, but that's not going to convince a court that Amazon's justified in charging someone $1000 to send a few hundred emails.

          • by Buran (150348)

            Not if Amazon then sends the agreement you signed when you signed up for service that includes "you will be charged $1000 if you violate these terms". The bank will turn around and say "Sorry, you lose, charge stands."

            • by mysidia (191772)

              False.

              Billing someone's CC company an amount is not a legal way of forcibly obtaining a remedy for breach of contract.

              Anymore than they could legally write a check out to themselves for $1000 and forge your signature if you had agreed to pay.

              Authorization for a charge to be made against a certain CC is very specific and cannot be created merely by a paragraph in a Terms of Service agreement of any sort.

              Specific authorization is required for the exact payment, otherwise it is a deceptive practice,

              • by Buran (150348)

                True.

                I have personally heard from people who have been billed for not living up to an agreement, then tried to dispute the charge, and were told that the agreement they signed states that their behavior automatically incurs a charge. They lost the chargeback dispute.

                • by mysidia (191772)

                  Banks findings may in a sense be arbitrary, depending on the manner in which an item is disputed and what claims are made in the dispute. Different conclusions may be reached, according to different particulars, so a personal anecdote or two about what a bank did is meaningless.

                  The process doesn't end just b/c the bank happened to decide one way or the other.

                  The FCBA permits the one done wrong to sue the bank based on, for example, the quality, or lack of merchandise received in exchange for the charge.

      • Re:Terms of Service (Score:5, Interesting)

        by macx666 (194150) * on Wednesday July 02, 2008 @03:35PM (#24035219) Homepage

        Then amazon needs to do a much better job of determining who their clients really are, and there are quite a few fairly reliable ways of doing so.

        Nothing is perfect, but it can be made very hard.

      • Re: (Score:3, Insightful)

        by MrMr (219533)
        Depends, if it is not reported stolen; tough luck for the card holder, if it is; tough luck for the credit card company.
        • Re:Terms of Service (Score:5, Informative)

          by rnswebx (473058) on Wednesday July 02, 2008 @04:33PM (#24035815)

          Actually, tough luck to vendor who allowed the fraudulent transaction. The credit card companies themselves typically have very little (any?) responsibilities when it comes to fraudulent transactions. It's entirely up to the vendor to do the proper verification prior to billing a transaction, as far as I know.

          The problem is that these small fraudulent transactions are typically more expensive to track down than they are to write off. If someone racks up a $1,000 bill on the ec2 cloud with a stolen card, the credit card company isn't out a dime, and the vendor (in this case Amazon) isn't likely to spend much time finding and prosecuting whoever is using the stolen card because it's expensive and time consuming to do so. Sure, maybe some ip addresses will be blocked and cards added to blacklists (temporarily?) but that doesn't stop the next guy from doing the same with a new stolen card.

          • by EVil Lawyer (947367) on Wednesday July 02, 2008 @10:35PM (#24039229)
            What's interesting about the set up (where the merchants are responsible for the fraud, not the credit card companies) is that the card companies have very little incentive to prevent fraud. In fact, they frequently have a disincentive: They collect a $25+ per charge "chargeback fee" from the merchants, for fraudulent charges. It would be in credit card companies' interests if fraud increased! (Of course, not past the level where merchants are hurt too badly to stop accepting cards).
    • Re:Terms of Service (Score:5, Interesting)

      by MBCook (132727) <foobarsoft@foobarsoft.com> on Wednesday July 02, 2008 @03:35PM (#24035215) Homepage
      No kidding. I'd say you have to put up a bond if you want to be able send more than some small threshold of emails out per day (100?). If you're good, you are safe. Maybe you get your bond back after 6 months. If you misbehave, Amazon cuts you off and you just lost $5-$10k.
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Crap idea. Small start-ups use this kind of service instead of a dedicated server in a server farm. Compare costs and you'll see why.

        What is small for emails? One small project I set up has over 5000 users, when their reports are ready they get notified, when something changes, they get notified.

        6 months of spam will generate a hell of a lot more than thr $5-10k bond.

        There are far better ways to stop spamming. Follow the money all the way to the companies selling the drugs, watches, or whatever. Someone is

        • by MBCook (132727)

          Yes, they do sent tons of emails. I've worked on those systems as they started up. My idea of the cap was for people who are using the service for more background processing type things. Amazon can decide on their own magic level. Maybe it's 3,000 a day. Maybe 10k. Maybe it's based on your bond size.

          Yes, you can send a ton of spam in 6 months, but you don't get to under by idea. As soon as you start spamming, you lose your bond. That's it.

          So to get around the bond, you have to PAY $5-$10k, hold the accoun

        • You do know that to post a $5000 bond, you generally don't actually have to post $5000, right?

          I believe the cost to post a $500,000 bond for someone with a fairly good credit record and sufficient security was about $1500/yr when last I checked.

          • by the_B0fh (208483)

            Only if you're buying it from a 3rd party/insurance company. If Amazon is charging *YOU* $5k bond, you have to put up all $5k with Amazon. Unless you buy a 3rd party bond. But, remember what you just said about good credit record? That means, if you're using a stolen credit card, you probably won't get it. Or, you may, in the first few cases, until the insurance/bond companies figure it out.

      • I really can't see Amazon actually implementing this, but supposedly they take malicious usage "very seriously." Earlier this week a server that I host had some script-kiddie at one of their IP addresses (67.202.37.137, if you want to block it) playing the guess-the-SSH-login-and-password game (until I set it to drop all packets from that IP). I've sent them the applicable sections of my logs; we'll see how well they handle it, but to be honest, I'm a bit skeptical.

        I personally find it to be a bad sign th

        • Apparently my earlier impression of Amazon seems to be correct, as I heard back from them a few hours ago, and what they had could be summarized like this:

          We received your report. We made some minor effort to look into it and it did come from our network, but we didn't do it. Please look at this URL [amazon.com] which talks about buying service from us. We do make some pretense at caring, because the customer's actions are prohibited by our terms of service. However, they've terminated usage a few days ago, but we c

    • by Chalkboy (1265438)
      Brilliant!
    • by merreborn (853723)

      Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them

      As a web app developer, that's potentially a dealbreaker for me. Who determines what spam is?

      According to the five-ten DNSBL, anything that's sent w/o a closed loop opt in is spam. So they block all sorts of ips the rest of us might think of as legitimate, like "microsoft, multiple public radio newsletters (from different radio stations in different states), travel notifications and newsletters from Expedia and Hotw

      • by hostyle (773991) *

        Don't like their terms? Don't use 'em! Its not like you're giving them money to filter out your spam, are you?

        • by merreborn (853723)

          Don't like their terms? Don't use 'em!

          That was my point. I'd anticipate that *many* people would find these terms unacceptable, and choose not to "use 'em". I would also expect that amazon's well aware of this, and would never implement such absurd terms in the first place.

    • They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.

      You just don't get it. Spammers can make more than $1000 per instance of malware or spam blast if their hook is effective enough. Pay the penalty and spam again is what they'll do in that situation. Any profit can be duplicated repeatedly and that's how these guys work.

      Amazon can't let these people back in the game after a s

    • by mysidia (191772)

      There is possibility that some of the spamming is not being initiated by instance owners, but by blackhats who have hacked into someone else's Amazon EC2 instance and started using it to spew spam.

      In that case Amazon would be pissing off an innocent customer: attempting to extort $1000 from them, and possibly putting themselves in an actionable position.

      Meanwhile, spammers continue and don't care. The CCs were stolen anyways, they'll just make a dozen new accounts tomorrow with the next batch of fake C

  • by teh kurisu (701097) on Wednesday July 02, 2008 @03:32PM (#24035171) Homepage

    Why aren't Amazon terminating the accounts of offenders, and blacklisting whatever payment method they're using? It's a paid service, it's not like spammers can register for new accounts as much as they like, they're going to run out of credit card numbers (well, assuming their activities aren't more nefarious than mere spam).

    It's not in Amazon's interests to have EC2 blacklisted.

    • Re: (Score:3, Insightful)

      by RabidMoose (746680)
      I agree with parent. This should be a non-issue. Just shut the account off, (possibly with a fine, as suggested elsewhere), and disallow the account holder from creating another account.
      • Re: (Score:3, Interesting)

        by dedazo (737510)

        I agree of course, but how exactly do you go about identifying these people so that they don't open another account? Credit card numbers? PayPal accounts? Last names? What?

        Nothing prevents Joe Spammer from creating a second account as Joe Spammer Thornton III a day after the first one is turned off. The capabilities of Amazon's cloud are too juicy to pass up.

        • Easy enough. Just require that Mailing Address == Billing Address. Sure, it won't stop 100%, but it'll certainly make it a lot harder (and more expensive) on them.
        • Re: (Score:1, Interesting)

          by Anonymous Coward

          how exactly do you go about identifying these people so that they don't open another account? Credit card numbers? PayPal accounts? Last names? What?

          How about a driver's license or other gov't-issued ID? Do whatever the CAs say they do.

          How are these people paying Amazon: cold, hard anonymous cash? Probably not. Supplying an ID when you pay for something by credit card or check, isn't all that unusual in retail business.

          But it's unusual in online business. Well, maybe it shouldn't be, if the person

        • by Todd Knarr (15451)

          Amazon has billing information for those accounts. Money changes hands. So, require that the name and address given to Amazon when setting up the account match the billing name and address of the credit card used to pay for the services. Most mail-order and on-line merchants do that already, and won't ship except to the billing name/address. Then block known pre-paid debit card numbers and one-time card numbers. Not perfect, but it should knock down 90% of the problems and make it a lot harder for a crimina

          • Re: (Score:2, Insightful)

            by rnswebx (473058)

            I think you're missing the point. If the offenders have stolen credit cards, they likely also have the correct name and address to go along with them. Adding electronic verification does absolutely nothing to solve the problem, unless we start requiring matching state issued IDs or SSNs to our cards. The obvious problem with that is now we're allowing even more private, extremely sensitive data to flow across the internet.

            It's a difficult problem to solve; certainly more so than simply requiring matching

            • by Todd Knarr (15451) on Wednesday July 02, 2008 @05:19PM (#24036455) Homepage

              There's actually a solution to that, but it involves slowing the process down. Just don't activate the account once the information's entered. Instead, send a physical letter to the credit-card billing address. You can require a form to be signed and returned, or just include an activation code in the letter that has to be entered to turn the account on. That should make it infeasible to use 99% of stolen cards. It introduces a few days of delay between requesting the account and getting it, but IMO if you intend to use the account for any length of time a few days shouldn't be an issue and if you don't then you're likely exactly the kind of person this is intended to filter out.

              • Re: (Score:2, Informative)

                by rnswebx (473058)

                I remember when PayPal did that when I opened my account back in 2000. I'm not sure if they still do that, but it certainly is a solution. It adds significant time, infrastructure (auto mailing facilities, employees, machines, etc) -- which all boil down to cost. I didn't like waiting the 4 or 5 days for my secret pin to arrive. On the other hand, if I applied for an account and either my pin didn't work or I never received it and I had to go through it multiple times, I'd probably start looking at othe

        • I agree of course, but how exactly do you go about identifying these people so that they don't open another account? Credit card numbers? PayPal accounts?

          Yes.

          • by adpowers (153922)

            You assume it is that easy? I mean if Amazon had this huge retail arm that they could leverage that had to deal with credit card fraud for the past decade, then maybe, but a small startup like Amazon? You ask too much sir!

      • Re: (Score:2, Offtopic)

        by gnuman99 (746007)

        You cannot "fine" anyone for anything. Amazon does not create the law which can punish users.

        What Amazon can do is have a "service reactivation fee" that is required to be paid to reinstate suspended accounts.

  • by fuzzy12345 (745891) on Wednesday July 02, 2008 @03:36PM (#24035225)
    Previously, senders of large volumes of paid-for (by the sender) yet unwanted (by the receiver) emails had to corral their own clouds of distributed, low-cost computing resources (a.k.a botnets). Amazon provides similar capabilities for pennies an hour. Both Amazon's and the emailers' business models work, and questionable penetration of third parties' computers is no longer required.

    Somebody finally solved the ????? = Profit equation. What's everyone getting so worked up about?

    • by QuantumRiff (120817) on Wednesday July 02, 2008 @03:39PM (#24035263)
      Amazon will fix this, as soon as they have an incentive to do so. IE, if enough blocklists start adding their IP's, customers will threaten to take their business elsewhere, as their legitimate emails are not going through.. then, and only then, will amazon act (and only if the cost benefit to fix are less than the development time, and income from spammers). Would you expect a corporation to do differently?
  • or virtual/private server company? And what would happen to the spammers? Account cancelled, so they'd just find another colo/host, or use one of many stolen credit cards to register another account with same host, under a different name. How is this any different?

    • Re: (Score:3, Insightful)

      by klingens (147173)

      The hoster terminates the client and won't sign him up again. Amazon could easily do he same but doesn't. Instead the only terminate the instance.

  • by Thelasko (1196535) on Wednesday July 02, 2008 @03:49PM (#24035355) Journal
    I'm afraid taint.org might not be safe for work.
  • by SanityInAnarchy (655584) <ninja@slaphack.com> on Wednesday July 02, 2008 @03:57PM (#24035443) Journal

    Once they have the name of the instance, they also know who launched it -- after all, they are billing someone.

    I like the suggestion to charge a large fee to the credit card they have on file, but what about simply banning the account in question?

  • Honeynet Project (Score:2, Interesting)

    by fatrat (324232)
    The UK Honeynet Project spotted this a few days earlier :) http://www.ukhoneynet.org/2008/06/30/it-had-to-happen [ukhoneynet.org]
  • Offer a spamfree block of IPs using their persistent IP offering, and let people put in a large deposit when getting an IP there. If they spam, confiscate the deposit. Use the interest on the deposit to offset the cost of triaging abuse complaints.

    Although if mail is incidental to your business you can probably just host a relay offsite.

  • by EdIII (1114411) * on Wednesday July 02, 2008 @05:13PM (#24036371)

    Here is a wild idea... WILD.. Off the hook insanity....

    Just block ALL of EC2 from being able to send out anything on port 25 and 587.

    Problem solved. Last time I checked EC2 has a lot more interesting uses than running mail server software.

    • by uncqual (836337)
      If this would work, it would probably need to be combined with one of the other ideas above -- either requiring additional verification or posting a bond to remove the filters from instances created under a verified/bonded account. Some users will have legitimate reasons to send emails (some a few, some many) but many probably don't.
  • I think all the ideas of placing a deposit or putting an extra charge per message are against the EC2 model. The whole idea is to offer a high capability solution at a low entry price that scales easily.
    Spammers and abusers tend to have distinctive patterns and this what Amazon should be paying attention to. Ie. some guy using a US credit card, logging to his instance from eastern Europe and sending a zillion emails messages the second day after sign up should raise some doubts. Manual inspection of suspic
  • why not run an inward facing IDS- something like snort. It's easy enough to setup a script that automatically terminates accounts of people sending abuse, and to do it on the first instance of that abuse.
  • You have created a legal botnet with as bad a reputation as the illegal botnets.

    From an address-reputation perspective EC2 is no different than, say, China. Connections from China start life much closer to my filtering threshold that connections from Europe because a far lower percentage of the connections from China are legitimate. EC2 will get the same treatment - link [networkmirror.com]

All life evolves by the differential survival of replicating entities. -- Dawkins

Working...