Amazon Goes Black Hat, Hires Patty Hewes to Defend Attacks

Amazon's EC2 service is part of AWS. It allows customer with an Amazon account to create servers in the cloud. It also has, as Amazon knows, a huge potential for abuse, if Amazon allows its customers to continue to attack other servers from the Amazon IP addresses.

The executive summary is this:

  • Many people running VoIP servers have experienced severa attacks on resources and break-in attempts.
  • The people running the attacked servers are techies and they know how to report the incidents in a precise manner
  • They have all attempted to contact Amazon's abuse team with mixed success
  • Amazon has told some people they will simply introduce the two parties and let them work it out
  • Amazon has told others that they do not feel responsible for the actions of their clients

Long story short, Amazon's attitude is unacceptable and their image as a good company with the smiling Jeff Bezos is already severaly tarnished. Amazon needs to realize a few thing:

  • All geeks are major consumers of books, music, electronics - HELLO? I'm writing them today about how they will lose my business if they don't act on these issues
  • Amazon has detailed customer information on the abusing instances. If an ISP can identify people to sue for RIAA from identical information (originating IP address and exact time from logs) why can't Amazon shut down these customers
  • Technology is fast, abuse like this could be shut down very quickly if they wanted to cooperate
  • These attacks are, unlike spam, not just annoying, they are costing innocent businesses money, time and possibly customer loss.
  • Customers of the attacked servers are potentially losing the phone lines and losing business

Amazon EC2 is a commercial, revenue producing offer, not an open source project. Amazon must put adequate resources into the prevention and suppression of abuse. Amazon needs to set the standard for potential abuse of cloud services so that their competition too will be forced to use prevention and suppression.

BACKGROUND: REFERENCE MATERIAL

Voip Tech Chat: First the abuse form didn't work, then the snow job from Amazon's PR, Kay Kinton.

Building the Net : This says it all:

“I’m sorry, you have reached a company that doesn’t care that we are attacking you…”

VOIPSEC (Dan York) : "...multiple reports out there of SIP attacks emanating from servers hosted on Amazon's EC2 service"

Digium Asterisk Mailining List Archive: "being hit with about 200 requests per second"

If Amazon can't correct this situation it's bad news for them, bad news for VoIP and bad news for the cloud.

2009.117: Capitalism and the Free Market, Both Sides Now with #mturk

I've been experiencing Amazon Mechanical Turk (AMT or mturk) for a couple of weeks. I'd been hearing about it for a long time, it started around 2005 and every time AWS came up with something new, mturk was also mentioned.
 
If you haven't heard, mturk is a marketplace where workers and employers are brought together with small  jobs called Human Intelligence Tasks, or "HITs". These are tasks that a machine can't easily do but a human can.
 
What brought me to action on AMT was that I wanted to get a transcript  of a one-hour podcast. I priced the service on the web and saw $90-$150.  I can't justify that much expenditure, so I posted a job on mturk, breaking up the hour into 6-ten minute segments and offering about $5 each. The work was returned quickly, the quality not perfect but adequate. Then I noticed that the same company that charges $90 per hour  has jobs on mturk paying $2 for 10 minutes. That's equal to $12 per hour of transcription, which they sell for $90.
 
I got curious and started doing some of the HITs myself. For example, I  earned 5 cents to identify an object in 25 photos. The more interesting
work for pennies is writing blog posts and reviews. Looking into this side of things, you see how certain reviews are written by people who
haven't used or even seen the product or service being reviewed and are instructed to NOT mention they are being paid to write it. There are a
few "fun" jobs like writing real reviews of local eateries or special tips for travel. As I delve into AMT, I see deeper implications as well as the most superficial exploitation.
 
The bottom line in all this is that as you look around in AMT, you will  learn a lot about the human condition around the world. There are two good forums to see what workers and work requesters are saying about Amazon and each other:
 
http://www.turkernation.com/
 
http://www.mturkforum.com
 
 
I've also started trying to bring workers and requesters together every Wednesday in a live Turkers Talk teleconference.  So far, we've had some interesting people on, talking about their  motivations and their experiences.