5 ms·

I have been wondering about the AWS GPU instances. They are something like $2.60 / hour. At what point do they make sense monetarily? You can build a machine li

I have been wondering about the AWS GPU instances. They are something like $2.60 / hour. At what point do they make sense monetarily? You can build a machine like described here for ~$5000 total. Thats not that many hours of AWS time. So if anyone is doing any long running cracking, or machine learning, does it ever make sense? I am truly curious about what people's experience has been.

dogma1138 10y ago
g2.8xlarge $0.7414 per Hour (linux pricing) it makes sense unless you are doing it for a "hobby", you just roll costs into each project which makes it much easier from an accounting POV :P
illumin8 10y ago
If you buy Spot instances you can get them for ~85% discount off normal pricing. Your spot instances can be pre-empted, of course, but for password cracking this shouldn't really matter much.
ryanlol 10y ago
>At what point do they make sense monetarily? For password cracking? Never, especially considering you can just go on insidepro or something and rent access to someones cluster.
- dogma1138 10y ago
  Insidepro is a great resource, but you usually aren't going to get a VAT invoice to either bill your client for or deduct in your taxes ;) AWS is simple, it's not overly expensive for most password cracking ventures (e.g. password quality audit that certain organization like to do on their AD/LDAP) and more importantly you aren't giving away potentially very sensitive information to people that by default cannot be trusted. Inside pro is ok if you are going mostly non-legit / off the books to begin with, it's also ok for basic research on non-real world data, but never use it for actual real world data not to mention B2B services.
BrainInAJar 10y ago
Cloud is a no-go if you're handling sensitive client data (like all of their passwords)
- jfoutz 10y ago
  Huh, interesting. I know Amazon, at least, has provisions for HIPAA, [1] which seems pretty strict. Having to notify newspapers in case of breach and some pretty stiff fines. I know a bunch of places do credit card processing on AWS. PCI is pretty strict as well. Is the big concern physical access? Or is there a subtle hack to escape the VM you're running in? I'm just having a hard time seeing the difference between a vm connected to the internet at the office, a colo server and a aws instance. I guess you must be referring to minimizing surface area, not a proven attack. It's tempting to trust your team, and you need to. If you're doing real, regular audits of access controls and have some pretty robust physical security, that could be a win. Seems like you'd have to be a pretty big shop to do security "right". [1] https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/
  - BrainInAJar 10y ago
    Compliance is not security. A sophisticated attacker with access to Amazon's infrastructure can read anything they like out of the memory of the machine your instance is on without you or anyone else ever knowing it.
    - dogma1138 10y ago
      If you are worried about actors with that capability you probably want to airgap your entire operation.
      - BrainInAJar 10y ago
        Doesn't need to be airgapped, just defended, and not in the cloud. If the client is someone like Juniper or Cisco (which, if you're a pentest firm buying 8x gpu servers for cracking hashes, would be a reasonable customer) nation state actors would absolutely love to have access to your dataset. And they're already in AWS's datacentres.

dogma1138 10y ago

g2.8xlarge $0.7414 per Hour (linux pricing) it makes sense unless you are doing it for a "hobby", you just roll costs into each project which makes it much easier from an accounting POV :P

illumin8 10y ago

If you buy Spot instances you can get them for ~85% discount off normal pricing. Your spot instances can be pre-empted, of course, but for password cracking this shouldn't really matter much.

ryanlol 10y ago

>At what point do they make sense monetarily? For password cracking? Never, especially considering you can just go on insidepro or something and rent access to someones cluster.

dogma1138 10y ago
Insidepro is a great resource, but you usually aren't going to get a VAT invoice to either bill your client for or deduct in your taxes ;) AWS is simple, it's not overly expensive for most password cracking ventures (e.g. password quality audit that certain organization like to do on their AD/LDAP) and more importantly you aren't giving away potentially very sensitive information to people that by default cannot be trusted. Inside pro is ok if you are going mostly non-legit / off the books to begin with, it's also ok for basic research on non-real world data, but never use it for actual real world data not to mention B2B services.

BrainInAJar 10y ago

Cloud is a no-go if you're handling sensitive client data (like all of their passwords)

jfoutz 10y ago
Huh, interesting. I know Amazon, at least, has provisions for HIPAA, [1] which seems pretty strict. Having to notify newspapers in case of breach and some pretty stiff fines. I know a bunch of places do credit card processing on AWS. PCI is pretty strict as well. Is the big concern physical access? Or is there a subtle hack to escape the VM you're running in? I'm just having a hard time seeing the difference between a vm connected to the internet at the office, a colo server and a aws instance. I guess you must be referring to minimizing surface area, not a proven attack. It's tempting to trust your team, and you need to. If you're doing real, regular audits of access controls and have some pretty robust physical security, that could be a win. Seems like you'd have to be a pretty big shop to do security "right". [1] https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/
- BrainInAJar 10y ago
  Compliance is not security. A sophisticated attacker with access to Amazon's infrastructure can read anything they like out of the memory of the machine your instance is on without you or anyone else ever knowing it.
  - dogma1138 10y ago
    If you are worried about actors with that capability you probably want to airgap your entire operation.
    - BrainInAJar 10y ago
      Doesn't need to be airgapped, just defended, and not in the cloud. If the client is someone like Juniper or Cisco (which, if you're a pentest firm buying 8x gpu servers for cracking hashes, would be a reasonable customer) nation state actors would absolutely love to have access to your dataset. And they're already in AWS's datacentres.