Jul 3, 2008 : Amazon EC2 Spam and Malware Problem

📅 July 3, 2008 - Malicious spam emails allegedly sent on Amazon's Electric Cloud 2 (http://www.aws.amazon.com/ec2) servers are making some commentators critical of the security risks that arise as the potential power of cloud computing opens up to all users, including spammers.


According to internet security firm Sophos (http://www.sophos.com) and others, spam traps found a malware campaign over the course of the weekend "using the common technique of disguising itself as an 'Important Windows Update'" that stemmed from Amazon's EC2.Websense Security Labs discovered the spam messages on Monday. Websense said the email message uses a redirect to a legitimate shopping site. The redirect then forwards users to a malicious URL offering to download an executable file. The malicious hostname is lengthy but is masked by sub-domain update.microsoft.com. The file, once opened, Websense said, will infect a user's desktop with a backdoor Trojan.

Marketed as a way for small to mid-sized companies to access an enormously powerful array of web-hosted applications, Washington Post computer security columnist Brian Krebs explored the implications that this holds for malicious users.

Outblaze (http://www.outblaze.com) head of anti-spam operations Suresh Ramasubramanian told the Post that EC2 is just another place for spammers and scammers to host their junk. Hong Kong-based Outblaze has gone so far as to list all of Amazon's EC2 Internet space on its spam blocklists.

Amazon responded that a clear, acceptable use policy is in place and all complaints of spam or malware coming through Amazon EC2 swiftly evaluated and network isolating or terminating is used to strictly enforce the use policy. However, some critics worry that by creating a new instance, malicious users can create new identities when their malware is found out.