Attacks/Breaches
2/14/2014
04:43 PM
50%
50%

Abusing Cloud Services For Cybercrime

At the upcoming RSA conference, researchers will discuss how a lack of anti-automation protections allow attackers to take advantage of free cloud services

Building a botnet typically involves infecting a PC. But at the upcoming RSA Conference, two researchers plan to show how to build one with free cloud services.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Bishop Fox security researchers Oscar Salazar and Rob Ragan were able to automate the process of signing up for accounts on various cloud services, opening the door for abuse of legitimate cloud infrastructure in the name of cybercrime. It is not the first time that researchers have discussed the use of cloud platforms by attackers. Recent research (PDF) from Solutionary, for example, showed that cybercriminals are increasingly using legitimate hosting providers, such as Amazon and GoDaddy, to host malicious domains.

As cloud services have grown in popularity, so has the desire for attackers to use these services to power their attacks.

"If you look at it from a physical perspective, a criminal that uses their personal belongings in criminal acts risks confiscation of those belonging by law enforcement if caught," says Jeremy Scott, senior research analyst at Solutionary. "The same holds true in the cyberworld. Also the use of hosting services ... provides availability and redundancy that is harder to achieve on personal equipment running in your basement."

According to Ragan, he and Salazar noticed many platform-as-a-service or infrastructure-as-a-service providers offering free trials for customers. That got them thinking.

"We started getting this idea," Ragan says. "What if we could automate the process of signing up for free trials in bulk and circumvent any anti-automation that was in place?"

Many of the services -- roughly one-third of the ones they looked at -- required only email verification to create and register accounts, Ragan says. That is one of the biggest mistakes providers can make.

"It's really trivial to get a lot of email addresses and automate a process of automatically clicking confirmation links," Ragan says.

The goal of the project was to demonstrate how attackers could obtain as high a level of processing power, disk space, and network bandwidth as possible for free. In one case, they took advantage of a customer referral program offered to potential customers.

"Many cloud data storage providers offer special deals to get additional space if you refer a friend to sign up using a promo link," Ragan explains. "We automated the process of visiting that promo link and registering new accounts to create a single account that has 1 TB of storage space for free."

Some companies had other methods designed to prevent automated account creation, such as requiring credit cards, but those techniques were circumvented as well. "SMS verification can be subverted using freely available online services, such as http://www.receivesmsonline.net/, and they are actively being used for account activation if you look at the logs: http://www.receivesmsonline.net/receive-sms-online-vip-14156121873.html," he says. "Google Voice and Phone Burner are other services that provide freely available VoIP numbers that can send and receive SMS."

"Credit card verification can, in some cases, be subverted using prepaid Visa Credit cards as ... they do not even charge the account for the free trial," Ragan adds.

The situation can create myriad problems for organizations looking to block attacks, as it may be problematic to block certain services if they are critical to the business, Ragan says. In addition, it complicates attempts to gather evidence against an attacker if there is no evidence of the data they stole on their machine. In order to address this behavior, cloud providers need to improve their use of anti-automation techniques, he says.

While some of the services the researchers used have shut down their free trial programs, they are unlikely to end entirely due to businesses wanting to sign up as many users as possible, he adds.

The researchers' presentation is scheduled for Feb. 27.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.