Amazon's EC2 Having Problems With Spam and Malware 103
jamie pointed out a story about the recent problems Amazon's EC2 service has been having with malware and spam. "EC2 space is now actively blocked by Outblaze, and has been listed by Spamhaus in their PBL list [...] However as Seth Breidbart noted in the comments, 'note that Amazon will terminate the instance. That means that the spammer just creates another instance, which gets a new IP address, and continues spamming.' True enough -- as described, instance termination simply isn't good enough."
Re: (Score:1)
Death Penalty (Score:5, Funny)
While I'm against the death penalty, I might be willing to consider it for spammers.
Re:Death Penalty (Score:5, Funny)
Now thats the REAL instance termination we need!
Not spam filters, SPAMMER filters!
Re: (Score:3, Interesting)
I don't see why the government doesn't prosecute the companies that have their products spammed. They are the absolute root of all this. Without them, there wouldn't be any placebos to sell so that they can hire more spammers. There's got to be SOME way to get to them.
Re:Death Penalty (Score:4, Insightful)
Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.
Re: (Score:3, Informative)
Your suggestion is equivalent to throwing knife makers in prison because some of their customers misuse the product.
Actually, it's more like going after gun dealers who don't go through standard procedures before selling a gun. If you held the companies responsible, believe me there would be more initiative to prevent spamming. That, and it's not tough to nail companies that ship a large amount of placebos and claim them to do things they don't.
Re: (Score:3, Interesting)
Re:Death Penalty (Score:5, Insightful)
As someone who has been involved with both sides of an affiliate program myself, I tend not to agree with your assessment. The company I worked for did an amazingly good job of keeping spammers from promoting our products. We had people on this continuously. These aren't random folks, they're people who we are paying (i.e. have an ongoing legal business relationship with) to bring customers to us. You can damn well bet it's our responsibility to make sure they act appropriately: they're our employees (claims of "independent contractor" notwithstanding).
I think that a reasonable legal framework for applying pressure to companies that benefit from spammers is warranted. I would have been glad to work under such a framework myself. Really, there's no excuse.
Cheers.
Re: (Score:2)
If that were done it would just become another extortion technique: cough up or I'll send SPAM in your name and the government will beat you up. Or just to hurt some company you've taken exception to.
Sure: if you can trace a Spammer back to a customer then take action against that customer. But I suspect that would be easier said than done.
Re: (Score:2)
That's mostly a problem for illegitimate companies. If you take a look the bulk of the spam that makes the major revenue (i.e. online pharmacies), you'll see that they rely on consistent spamming. Legitimate companies do not, and therefore the government will go a bit easy if there is a spammer out there that tries that. Without funds to go on, the spammer only wastes resources. Besides, the government knows that legitimate companies get themselves hurt with spam since it damages their rep. and they usually
Re: (Score:2)
When SPAM first started it was from legitimate companies. And who says what's "legitimate"? Maybe a big company wouldn't want their name tarnished, but it might be more tempting for a smaller business. I can imagine some person running a business from home selling, say, macrame cooking pots over the internet deciding that a bit of spam was worthwhile as a cheap way to reach an international market. Or that spamming in the name of their rival down the road - or across the ocean - is tempting.
Re: (Score:2)
One reason is that much of the time the products are fake [spamdailynews.com].
Re: (Score:1)
Re: (Score:1)
Never fear citizen! The Waahmbulance is on its way.
Re: (Score:2)
That's how I roll.
Terms of Service (Score:5, Insightful)
They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.
Re:Terms of Service (Score:5, Insightful)
And what if the credit card in question is stolen?
Re:Terms of Service (Score:5, Insightful)
Then the owner will actually notice that his/her card is stolen, and finally go over the bill with a fine-toothed comb, disputing charges as they go.
Nothing is lost.
Re:Terms of Service (Score:5, Insightful)
That's something of an extreme approach. Not exactly the sort of behaviour that would endear a company to its customers.
If your EC2 account got hacked (which may happen if its worth the effort), you would end up hacked, billed, and having quite possibly a hell of a fight to get your cash back.
Re: (Score:3, Funny)
No problem. EC2 is unhackable!
ppppppffffffffffffffft. Sorry, I couldn't say that with a straight face.Right, we just need the banks to not be stupid. (Score:2)
Re: (Score:2)
Unless they use a fake visa (debit or check card) in which case the consumer has absolutely zero recourse.
Banks and credit unions are not held the same dispute structure as credit card companies (since the legislation concerning charge disputes was drafted and instituted during a more consumer-friendly congress than was legislation created for debit and check cards).
Re: (Score:2)
Perhaps.
Though (as you say) there's no law in place to enforce good behavior on the bank's part, I've always had decent luck with my bank when it came to sorting out weirdness with debit cards.
Re:Terms of Service (Score:5, Insightful)
Actually, both Visa and MasterCard hold banks to the same "Zero Fraud Guarantee" policy for Debit Cards as they do Credit Cards.
In fact, if you search Visa.com for their Consumer Credit Card and Consumer Debit Card pages, you'll see that the Zero Fraud Policy link on both takes you to the same page.
They require that banks put provisional funds back into your account within 5 days of the dispute being made. Most banks do this the same day. I bank at BoA and they do it within hours.
The policy extends to charges incurred as a side-effect of the fraud, like overdrafts.
It does not apply to pin-based transactions, but there are no pin-based transactions on the web anyhow.
This makes sense if you think about it and it has nothing to do with Congress. Many people are transitioning away from cash. I hardly EVER carry cash. I use my Debit card for everything. And Visa has a vested interest in seeing this continue. A HUGE interest.
Besides, there is no difference between "Banks and credit unions" and "credit card companies."
Visa doesn't give out credit. They don't even give out credit-cards. They just provide a clearinghouse network. On their end, a Debit Card transaction (non-pin-based) looks identical to a CC transaction.
Of course, none of this applies if your debit card doesn't carry a Visa or MC logo. But if that's the case, you're not using it online, anyway.
Re: (Score:2, Interesting)
I lost my wallet once on a saturday and didn't notice until monday. I went out for more beer saturday night and my wallet fell out of my pocket ( best guess of what happened since the pants I was wearing always lost shit from the pocket when I sat down ) when I got in my friends car. Sunday I didn't go out so never looked for my wallet. Monday I looked and couldn't find it. Checked my bank of america online page and saw fraudulent charges. Mostly from local conveinence stores and wal-marts. I contacted BOA
Re: (Score:2, Informative)
They'll dispute all the illegal $1000 charges by EC2 which would cost Amazon a hefty chargeback fee for each transaction reversed.
And possibly Amazon suffers other actions. Due to unjustifiable $1000 'surcharge' running afoul of consumer protection laws.
You and I may think spam's bad, but that's not going to convince a court that Amazon's justified in charging someone $1000 to send a few hundred emails.
Re: (Score:2)
Not if Amazon then sends the agreement you signed when you signed up for service that includes "you will be charged $1000 if you violate these terms". The bank will turn around and say "Sorry, you lose, charge stands."
Re: (Score:1)
False.
Billing someone's CC company an amount is not a legal way of forcibly obtaining a remedy for breach of contract.
Anymore than they could legally write a check out to themselves for $1000 and forge your signature if you had agreed to pay.
Authorization for a charge to be made against a certain CC is very specific and cannot be created merely by a paragraph in a Terms of Service agreement of any sort.
Specific authorization is required for the exact payment, otherwise it is a deceptive practice,
Re: (Score:2)
True.
I have personally heard from people who have been billed for not living up to an agreement, then tried to dispute the charge, and were told that the agreement they signed states that their behavior automatically incurs a charge. They lost the chargeback dispute.
Re: (Score:1)
Banks findings may in a sense be arbitrary, depending on the manner in which an item is disputed and what claims are made in the dispute. Different conclusions may be reached, according to different particulars, so a personal anecdote or two about what a bank did is meaningless.
The process doesn't end just b/c the bank happened to decide one way or the other.
The FCBA permits the one done wrong to sue the bank based on, for example, the quality, or lack of merchandise received in exchange for the charge.
Re:Terms of Service (Score:5, Interesting)
Then amazon needs to do a much better job of determining who their clients really are, and there are quite a few fairly reliable ways of doing so.
Nothing is perfect, but it can be made very hard.
Re: (Score:3, Insightful)
Re:Terms of Service (Score:5, Informative)
Actually, tough luck to vendor who allowed the fraudulent transaction. The credit card companies themselves typically have very little (any?) responsibilities when it comes to fraudulent transactions. It's entirely up to the vendor to do the proper verification prior to billing a transaction, as far as I know.
The problem is that these small fraudulent transactions are typically more expensive to track down than they are to write off. If someone racks up a $1,000 bill on the ec2 cloud with a stolen card, the credit card company isn't out a dime, and the vendor (in this case Amazon) isn't likely to spend much time finding and prosecuting whoever is using the stolen card because it's expensive and time consuming to do so. Sure, maybe some ip addresses will be blocked and cards added to blacklists (temporarily?) but that doesn't stop the next guy from doing the same with a new stolen card.
Re:Terms of Service (Score:4, Insightful)
Re:Terms of Service (Score:5, Interesting)
Re: (Score:2, Insightful)
Crap idea. Small start-ups use this kind of service instead of a dedicated server in a server farm. Compare costs and you'll see why.
What is small for emails? One small project I set up has over 5000 users, when their reports are ready they get notified, when something changes, they get notified.
6 months of spam will generate a hell of a lot more than thr $5-10k bond.
There are far better ways to stop spamming. Follow the money all the way to the companies selling the drugs, watches, or whatever. Someone is
Re: (Score:2)
Yes, they do sent tons of emails. I've worked on those systems as they started up. My idea of the cap was for people who are using the service for more background processing type things. Amazon can decide on their own magic level. Maybe it's 3,000 a day. Maybe 10k. Maybe it's based on your bond size.
Yes, you can send a ton of spam in 6 months, but you don't get to under by idea. As soon as you start spamming, you lose your bond. That's it.
So to get around the bond, you have to PAY $5-$10k, hold the accoun
Re: (Score:2)
You do know that to post a $5000 bond, you generally don't actually have to post $5000, right?
I believe the cost to post a $500,000 bond for someone with a fairly good credit record and sufficient security was about $1500/yr when last I checked.
Re: (Score:2)
Only if you're buying it from a 3rd party/insurance company. If Amazon is charging *YOU* $5k bond, you have to put up all $5k with Amazon. Unless you buy a 3rd party bond. But, remember what you just said about good credit record? That means, if you're using a stolen credit card, you probably won't get it. Or, you may, in the first few cases, until the insurance/bond companies figure it out.
Re: (Score:2)
I really can't see Amazon actually implementing this, but supposedly they take malicious usage "very seriously." Earlier this week a server that I host had some script-kiddie at one of their IP addresses (67.202.37.137, if you want to block it) playing the guess-the-SSH-login-and-password game (until I set it to drop all packets from that IP). I've sent them the applicable sections of my logs; we'll see how well they handle it, but to be honest, I'm a bit skeptical.
I personally find it to be a bad sign th
Re: (Score:2)
Apparently my earlier impression of Amazon seems to be correct, as I heard back from them a few hours ago, and what they had could be summarized like this:
Re: (Score:1)
Re: (Score:2)
As a web app developer, that's potentially a dealbreaker for me. Who determines what spam is?
According to the five-ten DNSBL, anything that's sent w/o a closed loop opt in is spam. So they block all sorts of ips the rest of us might think of as legitimate, like "microsoft, multiple public radio newsletters (from different radio stations in different states), travel notifications and newsletters from Expedia and Hotw
Re: (Score:1)
Don't like their terms? Don't use 'em! Its not like you're giving them money to filter out your spam, are you?
Re: (Score:2)
That was my point. I'd anticipate that *many* people would find these terms unacceptable, and choose not to "use 'em". I would also expect that amazon's well aware of this, and would never implement such absurd terms in the first place.
Re: (Score:2)
They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.
You just don't get it. Spammers can make more than $1000 per instance of malware or spam blast if their hook is effective enough. Pay the penalty and spam again is what they'll do in that situation. Any profit can be duplicated repeatedly and that's how these guys work.
Amazon can't let these people back in the game after a s
Re: (Score:1)
There is possibility that some of the spamming is not being initiated by instance owners, but by blackhats who have hacked into someone else's Amazon EC2 instance and started using it to spew spam.
In that case Amazon would be pissing off an innocent customer: attempting to extort $1000 from them, and possibly putting themselves in an actionable position.
Meanwhile, spammers continue and don't care. The CCs were stolen anyways, they'll just make a dozen new accounts tomorrow with the next batch of fake C
Terminate accounts not instances? (Score:5, Insightful)
Why aren't Amazon terminating the accounts of offenders, and blacklisting whatever payment method they're using? It's a paid service, it's not like spammers can register for new accounts as much as they like, they're going to run out of credit card numbers (well, assuming their activities aren't more nefarious than mere spam).
It's not in Amazon's interests to have EC2 blacklisted.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
I agree of course, but how exactly do you go about identifying these people so that they don't open another account? Credit card numbers? PayPal accounts? Last names? What?
Nothing prevents Joe Spammer from creating a second account as Joe Spammer Thornton III a day after the first one is turned off. The capabilities of Amazon's cloud are too juicy to pass up.
Re: (Score:1)
Re: (Score:1, Interesting)
How about a driver's license or other gov't-issued ID? Do whatever the CAs say they do.
How are these people paying Amazon: cold, hard anonymous cash? Probably not. Supplying an ID when you pay for something by credit card or check, isn't all that unusual in retail business.
But it's unusual in online business. Well, maybe it shouldn't be, if the person
Re: (Score:2)
Amazon has billing information for those accounts. Money changes hands. So, require that the name and address given to Amazon when setting up the account match the billing name and address of the credit card used to pay for the services. Most mail-order and on-line merchants do that already, and won't ship except to the billing name/address. Then block known pre-paid debit card numbers and one-time card numbers. Not perfect, but it should knock down 90% of the problems and make it a lot harder for a crimina
Re: (Score:2, Insightful)
I think you're missing the point. If the offenders have stolen credit cards, they likely also have the correct name and address to go along with them. Adding electronic verification does absolutely nothing to solve the problem, unless we start requiring matching state issued IDs or SSNs to our cards. The obvious problem with that is now we're allowing even more private, extremely sensitive data to flow across the internet.
It's a difficult problem to solve; certainly more so than simply requiring matching
Re:Terminate accounts not instances? (Score:5, Interesting)
There's actually a solution to that, but it involves slowing the process down. Just don't activate the account once the information's entered. Instead, send a physical letter to the credit-card billing address. You can require a form to be signed and returned, or just include an activation code in the letter that has to be entered to turn the account on. That should make it infeasible to use 99% of stolen cards. It introduces a few days of delay between requesting the account and getting it, but IMO if you intend to use the account for any length of time a few days shouldn't be an issue and if you don't then you're likely exactly the kind of person this is intended to filter out.
Re: (Score:2, Informative)
I remember when PayPal did that when I opened my account back in 2000. I'm not sure if they still do that, but it certainly is a solution. It adds significant time, infrastructure (auto mailing facilities, employees, machines, etc) -- which all boil down to cost. I didn't like waiting the 4 or 5 days for my secret pin to arrive. On the other hand, if I applied for an account and either my pin didn't work or I never received it and I had to go through it multiple times, I'd probably start looking at othe
Re: (Score:2)
Yes.
Re: (Score:2)
You assume it is that easy? I mean if Amazon had this huge retail arm that they could leverage that had to deal with credit card fraud for the past decade, then maybe, but a small startup like Amazon? You ask too much sir!
Re: (Score:2, Offtopic)
You cannot "fine" anyone for anything. Amazon does not create the law which can punish users.
What Amazon can do is have a "service reactivation fee" that is required to be paid to reinstate suspended accounts.
Sheesh, seems like a match made in heaven (Score:5, Interesting)
Somebody finally solved the ????? = Profit equation. What's everyone getting so worked up about?
Re:Sheesh, seems like a match made in heaven (Score:5, Insightful)
How is this different from any colo... (Score:2)
or virtual/private server company? And what would happen to the spammers? Account cancelled, so they'd just find another colo/host, or use one of many stolen credit cards to register another account with same host, under a different name. How is this any different?
Re: (Score:3, Insightful)
The hoster terminates the client and won't sign him up again. Amazon could easily do he same but doesn't. Instead the only terminate the instance.
Re:So what is EC2? (Score:5, Informative)
Re: (Score:1, Funny)
So what you're saying is we basically we had a unique opportunity for a slashdot user to get lucky?
Re: (Score:1)
~~~
Write in Cowboy Neal for President and Alex Birch [lifesabirch.org] for Vice-President.
Re: (Score:2, Funny)
No, it's apparently something in the Amazon. I guess Brazilian deforestation is a major contributor to the global increase in salted canned pig meat.
Re:So what is EC2? (Score:4, Funny)
Wikipedia says it's the north eastern corner of the city of London, roughly. I don't get the article, either.
Re: (Score:2)
I'd RTFA but... (Score:4, Funny)
Re:I'd RTFA but... (Score:5, Informative)
My thoughts exactly. Luckily, Brian Krebs at the Washington Post wrote about this in his Security Fix blog [washingtonpost.com].
Re: (Score:2)
Re: (Score:3, Insightful)
EV certificates cannot sign mail, only server to server communication. E-mail signing certificates cost about $30, and require absolutely no proof of identity, just existence. This is no barrier whatsoever.
Terminate the account! (Score:3, Interesting)
Once they have the name of the instance, they also know who launched it -- after all, they are billing someone.
I like the suggestion to charge a large fee to the credit card they have on file, but what about simply banning the account in question?
Re: (Score:2)
Honeynet Project (Score:2, Interesting)
Amazon needs to offer a spamfree block (Score:2)
Offer a spamfree block of IPs using their persistent IP offering, and let people put in a large deposit when getting an IP there. If they spam, confiscate the deposit. Use the interest on the deposit to offset the cost of triaging abuse complaints.
Although if mail is incidental to your business you can probably just host a relay offsite.
It's a problem? Really? (Score:3, Funny)
Here is a wild idea... WILD.. Off the hook insanity....
Just block ALL of EC2 from being able to send out anything on port 25 and 587.
Problem solved. Last time I checked EC2 has a lot more interesting uses than running mail server software.
Re: (Score:2)
How about improving the monitoring? (Score:2, Insightful)
Spammers and abusers tend to have distinctive patterns and this what Amazon should be paying attention to. Ie. some guy using a US credit card, logging to his instance from eastern Europe and sending a zillion emails messages the second day after sign up should raise some doubts. Manual inspection of suspic
instead of trying to collect after abuse, (Score:2, Insightful)
Congratulations Amazon! (Score:2)
Re: (Score:2)
(Damn. I've got modpoints, and professional experience at mailfiltering too - but I'll never find this thread again if pyster replies and I've posted AC... )
Which blacklist, and what reasons did they give for listing you? You want to whine and rant? Fine, that's what Slashdot seems to be made for. But if you want your point to be taken seriously and not modded into oblivion, give us the information that will allow us to make informed assessments of your claims about the lameness of the blacklist - and, poss
PBL is the wrong blacklist to whine about (Score:5, Informative)
Ah, the PBL. That's where your argument falls to pieces.
From http://www.spamhaus.org/pbl/index.lasso [spamhaus.org] :
PBL IP address ranges are added and maintained by each network participating in the PBL project, working in conjunction with the Spamhaus PBL team, to help apply their outbound email policies.
So, your ISP told Spamhaus that mail shouldn't be coming from the range your IP address is in. Not Spamhaus making a trite, petty and vindictive block for the fun of it. Not some blacklist deciding in error to block a whole /24 full of static addresses with REAL rDNS records for most of it because they found a couple of zombied machines with vaguely generic-looking PTRs in it. This is a case of the people you pay for connectivity telling Spamhaus that the rest of the world should not accept mail from your IP address or others near it until further notice - they're being good neighbours, and are to be applauded.
If you have a static address you can poke a hole in the PBL for it pretty easily - *you* can provide that further notice:
A feature of the PBL is the elimination of 'false positives' with a server-identifying and automatic removal mechanism for single IP addresses. This allows end users with static IP addresses within a larger dynamic pool, and legitimate mail server operators, to assert that in their opinion their IP addresses are a trustworthy source of email and to automatically remove (suppress) their IP addresses from the PBL database. Safeguards are built in to prevent abuse of this facility by spammers (and particularly by automated bots).
Do your research. The PBL is pretty damn useful, and you probably qualify for free use. If you have an unfiltered postmaster address on your domain (you do, don't you?) the smart thing would be to start blocking with it but make sure the rejection contains something like "Rejected: $IP_ADDRESS listed in Spamhaus PBL ( http://lookup-urlip_address/ [lookup-urlipaddress] ) - please contact postmaster@whineyblacklisthater.org for assistance if required" - you'll find that the "false-positives" for it are almost invariably from people who don't know what the PBL is and want to do their own thing, regardless of the practicalities the rest of the world has to face. Why should I or anyone else accept mail from somewhere your own ISP or their upstream provider has said I shouldn't?
Re: (Score:2)
Re: (Score:3, Informative)
Why do all the antispam nazi's solutions ignore the collateral damage to innocent by standers? "They should educate themselves" "they should switch providers" they scream. Black lists do nothing but break the system. I'd rather get all the spam than have important mail bounce. Just last week I had a mission critical email bounce because of some lame blacklist. This email not getting to its recipient would have basically ruined my life. Its a good thing I have the ability to send mail from more than once source.
If you formulate your mails the same way you usually formulate your posts on Slashdot [slashdot.org], I'm really not surprised, Mr. Fr0sti P1ss GNNA.
Re: (Score:1)