3 ms·

I wonder what kind of 'bad activity' detection Amazon does, if any? Did they have to call Amazon ahead of time, just to warn them they were about to boot up "3,

I wonder what kind of 'bad activity' detection Amazon does, if any? Did they have to call Amazon ahead of time, just to warn them they were about to boot up "3,809" instances? If I tried to do that, would Amazon prevent it? The reason I ask... how hard would it be to boot up, say 10,000 micro-instances (using a stolen credit card or AWS account) to be used for a DDOS? What do you have to do before red lights start appearing in the AWS NOC?

knorby 15y ago
They work pretty actively with amazon on any of these massive clusters. They call ahead of time and try and find a good time (US night), etc, as I remember hearing.
deleted 15y ago
[deleted]
davidblair 15y ago
Amazon limits you to 100 Spot instances per region without contacting them to change the limit for your account. http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run_in_Amazon_EC2 http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run...
- pavel_lishin 15y ago
  That wouldn't prevent someone from creating multiple accounts with stolen credit cards though, right? num_accounts * 100 = DDOS.
  - dholowiski 15y ago
    That wouldn't prevent it but it would make it much more difficult. Although, I suppose you could automate the whole thing, right from the stealing of the credentials to the booting up of 100 new instances and adding them to the ddos cloud. I wonder if this has ever been done, or if the number of AWS users is just too low to make it worthwhile (like the old argument of why macs don't have viruses)?
ericHosick 15y ago
They do have limits which you have to ask to remove. For example, you are limited to 5 elastic IPs per region. We had to ask to get that limitation removed and explain why we felt that we needed more EIPS. If I recall, we were also limited to (10?) instances and had to ask for more and explain why. It took a few days to get approved.
- eli 15y ago
  The requirement to explain why you need additional IP addresses likely just flows out of ARIN rules that say ISPs must be able to prove their customers are using addresses efficiently and with justification.

knorby 15y ago

They work pretty actively with amazon on any of these massive clusters. They call ahead of time and try and find a good time (US night), etc, as I remember hearing.

deleted 15y ago

[deleted]

davidblair 15y ago

Amazon limits you to 100 Spot instances per region without contacting them to change the limit for your account. http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run_in_Amazon_EC2 http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run...

pavel_lishin 15y ago
That wouldn't prevent someone from creating multiple accounts with stolen credit cards though, right? num_accounts * 100 = DDOS.
- dholowiski 15y ago
  That wouldn't prevent it but it would make it much more difficult. Although, I suppose you could automate the whole thing, right from the stealing of the credentials to the booting up of 100 new instances and adding them to the ddos cloud. I wonder if this has ever been done, or if the number of AWS users is just too low to make it worthwhile (like the old argument of why macs don't have viruses)?

ericHosick 15y ago

They do have limits which you have to ask to remove. For example, you are limited to 5 elastic IPs per region. We had to ask to get that limitation removed and explain why we felt that we needed more EIPS. If I recall, we were also limited to (10?) instances and had to ask for more and explain why. It took a few days to get approved.

eli 15y ago
The requirement to explain why you need additional IP addresses likely just flows out of ARIN rules that say ISPs must be able to prove their customers are using addresses efficiently and with justification.