Cloud services - A window to outsourcing illegal activities?

Question

Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, e.g Amazon, can be used for the sole purpose of malicious activity - For instance, renting a strong machine with a big number of processors and letting it run some sort of a brute-force, whether offline (a given file to crack) or over the internet.

A real example: (This site), owned by moxie - Supplies cloud services to crack WPA handshakes, and there is no need here to elaborate on the consequences and meaning of the availability of such service.

The question here is a bit blurred, but still important (in my opinion) - Doesn't it cross the line a bit? Of course some legitimate network administrators might use this service for their own organization and for a legit purpose, but I think there is a big window here for criminal activity.

Answer 1

Services and tools are entirely amoral, i.e. they are neither moral or immoral. We, as people, often place moral value on these tools' intended and actual use. Such reasoning is somewhat fallacious, since we cannot pre-judge the intent of every possible user. Any tool intended for "good" might be subverted for "evil", and vice versa.

A screwdriver can be used to construct a cupboard, but it might also be used to stab someone. A gun can be used to oppress, but it might also be used to protect. These are simplistic examples, but the point is that the tool itself has no moral value. Our actions are what carry moral value.

The cloud is merely a concept, which makes this abstraction all the more meaningless. Whilst the term has been heavily bastardised by salespeople, the real meaning of "cloud computing" is simply placing some computational task into a distributed system. Since the task can be anything, we cannot pre-judge intent, therefore it is amoral. Thus, we should not judge such services by their potential misuse.

Sure, the bad guys can use "the cloud" for bad stuff. It opens up new attack models and improved financial efficiency when performing distributed attacks. But is that not the same for any other technology? Brain-computer interfaces, webcams, smart-phones, tablets, smart-meters (electricity / gas), SCADA, Ajax, Facebook, etc. can all be subverted for immoral means, but it doesn't mean we should stop using them. Cloud computing is no exception. It goes the other way, too - tools like oclHashcat, BeEF, Metasploit, nmap, sqlmap, etc. can be used for "evil", but they're also amazingly useful for penetration testers.

In the end, we need to just accept that these services and tools exist, and that attempting to place moral value on them is an exercise in futility. Focus your efforts on identifying the potential problems and finding solutions.

Answer 2

I agree that some of the latest service offerings are crossing the line, but I also think it is a good idea that we have such services. Cloud computing is not going away, in fact it will become much cheaper and popular in the future. Now is the best time to test our security systems and technology, while it is still relatively difficult and rare to brake them successfully. We need to improve our security systems (ciphers, hashes, ...) to survive brute-force attacks from a billion computers, each with a modern CPU and GFX card. The solution is therefore not only to try and stop the cracking services, but also to improve security procedures and algorithms. Both need to be done for a safer world.

And as for WPA or WPA2, they are hardly the only ways to restrict access over wireless. You can use other methods like IPSec or OpenVPN and only allow access to the network through those. You are perfectly safe running an open wireless network, as long as you use these correctly.