4 ms·

Though there's a lot of food for thought in this article, it's obviously not written by a security expert. They vastly underestimates the "Enemy Action" risk.

by klik99 5y ago

Though there's a lot of food for thought in this article, it's obviously not written by a security expert. They vastly underestimates the "Enemy Action" risk. It won't be a DDOS attack that takes down us-east-1, it would be a Stuxnet level of direct targeting, using a combination of internal knowledge and nonlinear physical properties. And while he's right that professional hackers would have no interest in any Amazon data services (the time investment/reward is just not here), he says at the very beginning of the article a clear reason for state actors to go after it - it would cause a lot of economic damage, which is how wars are fought these days. Not saying it has any chance of happening anytime soon, but his idea of "Enemy Action" is limited. At any rate, it's bad business to put your eggs into one basket, and while it's less friction to use cloud formation, dynamodb, or anything that locks you into AWS - it's far better to make a system that can be deployed anywhere, at least when you start getting big enough that it matters.

peripitea 5y ago
I imagine any significant state actor already has multiple employees working inside AWS. I'm not an expert on state security apparatuses or anything, but that just seems so potentially valuable that I can't fathom why they wouldn't.
AccountToUse 5y ago
I think it would be the mother load for a ransomware gang. They would have many extortion opportunities. Pay us to get access back to your servers, pay us or we delete your data, pay us or we leak your internal data, pay us or we delete/leak your customers' data. I'm sure that AWS has some of the greatest cybersecurity out there. But the potential massive cash opportunities make it such that why not try some easy attacks against them. Spending millions of dollars of labor to research and pull off an attack is likely only for nation states, but ransomware gangs should be walking by and testing the locks all day every day.
- judge2020 5y ago
  Sure, but you never want to be US public enemy number 1. Any large-scale attacks on these big DCs themselves would be treated as national security threats/terrorist attacks since, as laid out here, a large chunk of the US economy is reliant on us-east-1. No matter how much money you get, you'd have to be in Russia and sponsored by the state itself to carry out these attacks if you wanted to remain free for longer than a few months (in which it could be considered an act of war). I guess the best way to do this without attempting a total shutdown of the dc (while still making off with $xx millions) would be to select a thousand customers, encrypt the hard drives that make up their data redundancy (live, backup, and sharded copies of the data), then ransom that. The only way this doesn't work is if they have all of it in a tape backup, but depending on how much you encrypt, that might be impractical for them to restore if it would cause significant downtime for those customers - and that could be mitigated by selecting petabytes of super-recent data that likely hasn't been backed up to tape yet.
  - PeterisP 5y ago
    Some of the ransomware actors would not be afraid of being labeled "US public enemy number 1" - for example, North Korea is running some operations, and they would really like to extract a hefty ransom in addition to hurting USA as Amazon's revenue is something like 10x the North Korean GDP.
    - judge2020 5y ago
      That would be a declaration of war, which is why ransomware by some cash-strapped group of hackers is generally not an attack vector, given taking us-east-1 offline being seen as terrorism and the resources the US would dedicate to bringing such actors to justice. It'll always be easier to attack random medium-large companies' office ops, which are likely manned by 0 or underskilled IT security personnel (at least in current_year). Even for some place like Russia, the attackers would either need to be state-sponsored or Russia would avoid war by performing the rare non-treaty-bound extradition.
      - PeterisP 5y ago

by klik99 5y ago

peripitea 5y ago

I imagine any significant state actor already has multiple employees working inside AWS. I'm not an expert on state security apparatuses or anything, but that just seems so potentially valuable that I can't fathom why they wouldn't.

AccountToUse 5y ago

I think it would be the mother load for a ransomware gang. They would have many extortion opportunities. Pay us to get access back to your servers, pay us or we delete your data, pay us or we leak your internal data, pay us or we delete/leak your customers' data. I'm sure that AWS has some of the greatest cybersecurity out there. But the potential massive cash opportunities make it such that why not try some easy attacks against them. Spending millions of dollars of labor to research and pull off an attack is likely only for nation states, but ransomware gangs should be walking by and testing the locks all day every day.

judge2020 5y ago
Sure, but you never want to be US public enemy number 1. Any large-scale attacks on these big DCs themselves would be treated as national security threats/terrorist attacks since, as laid out here, a large chunk of the US economy is reliant on us-east-1. No matter how much money you get, you'd have to be in Russia and sponsored by the state itself to carry out these attacks if you wanted to remain free for longer than a few months (in which it could be considered an act of war). I guess the best way to do this without attempting a total shutdown of the dc (while still making off with $xx millions) would be to select a thousand customers, encrypt the hard drives that make up their data redundancy (live, backup, and sharded copies of the data), then ransom that. The only way this doesn't work is if they have all of it in a tape backup, but depending on how much you encrypt, that might be impractical for them to restore if it would cause significant downtime for those customers - and that could be mitigated by selecting petabytes of super-recent data that likely hasn't been backed up to tape yet.
- PeterisP 5y ago
  Some of the ransomware actors would not be afraid of being labeled "US public enemy number 1" - for example, North Korea is running some operations, and they would really like to extract a hefty ransom in addition to hurting USA as Amazon's revenue is something like 10x the North Korean GDP.
  - judge2020 5y ago
    That would be a declaration of war, which is why ransomware by some cash-strapped group of hackers is generally not an attack vector, given taking us-east-1 offline being seen as terrorism and the resources the US would dedicate to bringing such actors to justice. It'll always be easier to attack random medium-large companies' office ops, which are likely manned by 0 or underskilled IT security personnel (at least in current_year). Even for some place like Russia, the attackers would either need to be state-sponsored or Russia would avoid war by performing the rare non-treaty-bound extradition.
    - PeterisP 5y ago