Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, e.g Amazon, can be used for the sole purpose of malicious activity - For instance, renting a strong machine with a big number of processors and letting it run some sort of a brute-force, whether offline (a given file to crack) or over the internet.

A real example: (This site), owned by moxie - Supplies cloud services to crack WPA handshakes, and there is no need here to elaborate on the consequences and meaning of the availability of such service.

The question here is a bit blurred, but still important (in my opinion) - Doesn't it cross the line a bit? Of course some legitimate network administrators might use this service for their own organization and for a legit purpose, but I think there is a big window here for criminal activity.

share|improve this question

2 Answers 2

Services and tools are entirely amoral, i.e. they are neither moral or immoral. We, as people, often place moral value on these tools' intended and actual use. Such reasoning is somewhat fallacious, since we cannot pre-judge the intent of every possible user. Any tool intended for "good" might be subverted for "evil", and vice versa.

A screwdriver can be used to construct a cupboard, but it might also be used to stab someone. A gun can be used to oppress, but it might also be used to protect. These are simplistic examples, but the point is that the tool itself has no moral value. Our actions are what carry moral value.

The cloud is merely a concept, which makes this abstraction all the more meaningless. Whilst the term has been heavily bastardised by salespeople, the real meaning of "cloud computing" is simply placing some computational task into a distributed system. Since the task can be anything, we cannot pre-judge intent, therefore it is amoral. Thus, we should not judge such services by their potential misuse.

Sure, the bad guys can use "the cloud" for bad stuff. It opens up new attack models and improved financial efficiency when performing distributed attacks. But is that not the same for any other technology? Brain-computer interfaces, webcams, smart-phones, tablets, smart-meters (electricity / gas), SCADA, Ajax, Facebook, etc. can all be subverted for immoral means, but it doesn't mean we should stop using them. Cloud computing is no exception. It goes the other way, too - tools like oclHashcat, BeEF, Metasploit, nmap, sqlmap, etc. can be used for "evil", but they're also amazingly useful for penetration testers.

In the end, we need to just accept that these services and tools exist, and that attempting to place moral value on them is an exercise in futility. Focus your efforts on identifying the potential problems and finding solutions.

share|improve this answer
    
I agree with you, but: Which of the 2 would you associate with a big potential for criminal activity? Facebook, which serves as a social platform for people from over the world to communicate with their friends (of course regardless of the fact that about 80,000,000 users are bogus and serve as marketing\malicious bots)? Or an Ad-Hoc service for cracking WPA\WPA2 handshakes (which is mostly associated to cracking Wifi, and not recovering the key). I would say there is a big difference between the two. Even too big. –  Franko Sep 11 '12 at 8:32
    
My point is that it doesn't matter. Both have big potentials for criminal activity - one more overt than the other. Both also have legitimate uses. The services are amoral. Focus on individual use-cases if you want to apply moral value. –  Polynomial Sep 11 '12 at 8:37

I agree that some of the latest service offerings are crossing the line, but I also think it is a good idea that we have such services. Cloud computing is not going away, in fact it will become much cheaper and popular in the future. Now is the best time to test our security systems and technology, while it is still relatively difficult and rare to brake them successfully. We need to improve our security systems (ciphers, hashes, ...) to survive brute-force attacks from a billion computers, each with a modern CPU and GFX card. The solution is therefore not only to try and stop the cracking services, but also to improve security procedures and algorithms. Both need to be done for a safer world.

And as for WPA or WPA2, they are hardly the only ways to restrict access over wireless. You can use other methods like IPSec or OpenVPN and only allow access to the network through those. You are perfectly safe running an open wireless network, as long as you use these correctly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.