Using temporary IPs in the cloud considered harmful

32 points by maconic 16 years ago | 22 comments

Here's an amusing hobby: 1. Start Amazon EC2 instances (or any other cloud service) 2. Use something like honeyd to listen on all ports 3. Wait for random activity associated with the previous owner of the EC2 instance to start flowing in.

I stumbled across this by accident after getting flooded by connections from apps.facebook.com which seems to be trying to interact with a Facebook app that was previously hosted on an IP which I'm now using. Presumably the previous owner of an EC2 instance had a DNS name that resolved to this IP and didn't see the risks of doing so. Remember: the Amazon public IPs are temporary and will be reassigned once the EC2 instance stops or dies.

For the sake of your users' privacy and security, use Elastic IPs. Even if the instance dies, the Elastic IP still belongs to you and won't be accidentally be reassigned to someone else. When you start up a new instance you can have the Elastic IP assigned to the new instance using ec2-associate-address.

brettnak 16 years ago |

Am I the only one who get's frustrated by 'considered harmful' titles? Sorry for being off topic.

EDIT: I'll give you that it's not as bad as the whole (win|fail|this) thing that's becoming popular.

cperciva 16 years ago | |

frustrated by 'considered harmful'

Yeah, this is a clear case of "... for fun and profit".

slioslat 16 years ago | |

"x considered harmful" considered harmful

mschy 16 years ago | | |

http://meyerweb.com/eric/comment/chech.html

cmelbye 16 years ago | |

I personally found the submission very informative and useful. I mean, "considered harmful" sounds a little weird, but doesn't really affect the content of the submission.

prodigal_erik 16 years ago |

For the sake of your users' privacy and security, use TLS (or IPSec) and a certificate that identifies your server. Anything sent in the clear is vulnerable to eavesdropping and tampering, whether or not the destination IPv4 address appears to be under your control.

eli 16 years ago | |

That's not always practical if you're interacting with another service like Facebook that won't know to check.

tptacek 16 years ago |

You should make a web site with examples or a report of the kinds of traffic you get. I'd do it, and get a zillion hits on it and probably some press attention, but it's your idea.

You have a really good point.

viraptor 16 years ago | |

A cloud version of the Museum of Broken Packets? http://lcamtuf.coredump.cx/mobp/ It could be interesting. Especially if you can identify some random proprietary/custom protocols.

wooster 16 years ago |

I still get requests to my dedicated server at Softlayer for the Facebook app which used it before me. I've had the server since mid-2008. Really, this seems like a problem on Facebook's side.

The bigger problem is trying to run a mail server on EC2. You can't, really, as a lot of providers are still doing (stupid) IP based filtering.

qjz 16 years ago | |

I've been permanently blocking all connections from any AWS/EC2 netblock I identify after an initial exploit attempt. I much prefer temporary blocks triggered by bad behaviour, but the constant onslaught from AWS finally got to be too much. In the last several months, blocking AWS has done more good than harm. I don't seem to be blocking any legitimate traffic or users, just badly behaved startups and downright malicious crackers. It was a tough compromise, but so far it doesn't seem stupid.

patio11 16 years ago | | |

Right.

Email has essentially converged on a patchwork ad-hoc net-wide implementation of a few of the proposals lampooned in the famous Slashdot copy/paste thing. Small businesses who are serious about getting their mail delivered pay what amounts to a delivery tax. The difference is it is not actually a tax, it is just a per-piece rate paid to a mailing service that keeps up with all the SPF records, feedback loops, blacklist monitoring, etc for us. However, considered from the perspective of the firm, it is essentially a tax, and it means that people paying a penny or two per email end up trustworthy. Everyone else is left in the email wild west, where they either have massive amounts of physical and reputational capital (Amazon et al) and get their mail accepted for free, or they're almost certainly trying to spam you (statistically speaking).

This is strongly related to strong centralization of email. I just had my 20,000th email submitted yesterday. Of those 20k, over 12k belong to just 10 domains. Even that overstates the diversity of spam squashing strategies, since most of the domains eventually use the same RBLs, etc.

holdenk 16 years ago | | |

How have you measured if its done more good than harm if your doing a complete block?