Intrustion attempts from Amazon EC2 IPs

2008-06-22 Thread Paul Kelly :: Blacknight
Hi there, Have any of you recently noticed a lot of ssh scanning coming from amazons EC cloud IP blocks? Today alone I've seen approx 4m attempts from EC2 IPs on just 20 nodes on our network. Has anyone any experience with Amazons abuse people? Thanks, Paul Paul Kelly Technical Director

Re: Intrustion attempts from Amazon EC2 IPs

2008-06-22 Thread Suresh Ramasubramanian
Well, there's spam originating from there, and some cracked scripts generating part of it. So ok, someone's found that it makes a handy platform for ssh port probes and such as well. srs Paul Kelly :: Blacknight [EMAIL PROTECTED] wrote: Hi there, Have any of you recently noticed a

Re: Intrustion attempts from Amazon EC2 IPs

2008-06-22 Thread Jon Lewis
On Sun, 22 Jun 2008, Paul Kelly :: Blacknight wrote: Have any of you recently noticed a lot of ssh scanning coming from amazons EC cloud IP blocks? Today alone I've seen approx 4m attempts from EC2 IPs on just 20 nodes on our network. That's not too surprising, since any unix-like system

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Paul Vixie
hi andy. with EC2, it's game-over for the IP reputation industry, I was discussing this on an e-commerce practitioners list earlier today, and argued basically that, from an abuse point of view, EC2 is the same as any other bad neighborhood, and that operators needing to make impact fast,

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Al Iverson
On Sun, Jun 22, 2008 at 11:55 AM, Andy Davidson [EMAIL PROTECTED] wrote: On 22 Jun 2008, at 17:17, Paul Vixie wrote: with EC2, it's game-over for the IP reputation industry, I was discussing this on an e-commerce practitioners list earlier today, and argued basically that, from an abuse

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Paul Vixie
From: Troy Davis [EMAIL PROTECTED] ... AWS already tracks VM instances and their internal IP allocations. They recently added elastic IPs, which are assigned to a customer rather than a specific instance. To the rest of the world, they're static IPs. abusers don't have specific identities.

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Steve Gibbard
On Sun, 22 Jun 2008, Paul Vixie wrote: it seems that amazon has succeeded where google and microsoft failed. with e-mail only services like hotmail and gmail, it was still possible to treat an IP address as having a reputation, and to therefore blackhole hotmail and gmail (and other free

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-22 Thread Paul Vixie
[EMAIL PROTECTED] (Steve Gibbard) writes: ... So yeah, if big shared services that include important stuff aren't being adequately policed, that's probably a problem for IP address reputation services. But that's not really a new problem being introduced by EC2. this may be an argument

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Suresh Ramasubramanian
On Mon, Jun 23, 2008 at 1:13 AM, Steve Gibbard [EMAIL PROTECTED] wrote: Likewise, anybody blocking EC2 would miss out on whatever bad stuff might be coming out of EC2, but would miss out on being able to access services hosted there as well. Would they miss it more than they'd miss their

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Nathan Ward
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 23/06/2008, at 4:17 AM, Paul Vixie wrote: as randy bush often says, it's just business. amazon has solid business reasons for creating EC2 and there's no way it could be profitable if they can't scale the user base, and there's no way to

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Laird Popkin
Normal hosting facilities let you do pretty much anything you want, unless you start causing problems for the ISP or their customers. You pay them to provide bandwidth, space, power and cooling. There are more restrictions for shared virtual sites (i.e. the $10/month web sites). Usually they