Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Amazon EC2 Enables Cheap Brute-Force Attacks

timothy posted more than 3 years ago | from the this-gun-for-hire dept.

Security 212

snydeq writes "German white-hat hacker Thomas Roth claims he can crack WPA-PSK-protected networks in six minutes using Amazon EC2 compute power — an attack that would cost him $1.68. The key? Amazon's new cluster GPU instances. 'GPUs are (depending on the algorithm and the implementation) some hundred times faster compared to standard quad-core CPUs when it comes to brute forcing SHA-1 and MD,' Roth explained. GPU-assisted servers were previously available only in supercomputers and not to the public at large, according to Roth; that's changed with EC2. Among the questions Roth's research raises is, what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

Sorry! There are no comments related to the filter you selected.

That's silly. (5, Insightful)

DWMorse (1816016) | more than 3 years ago | (#34868774)

"what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

The same role that Ford Motor Company is responsible to fill in preventing the use of it's vehicles as Getaway cars from scenes of crimes.

Offensive (1, Funny)

Anonymous Coward | more than 3 years ago | (#34868814)

From the article:

"This approach is so easy a grandmother could use it"

As a 49 yo grandmother, feminist, and C programmer I find that offensive. Why not a grandfather ?

Re:Offensive (5, Funny)

Anonymous Coward | more than 3 years ago | (#34868860)

Probably because grandfathers tend not to be bitches.

Re:Offensive (1)

natehoy (1608657) | more than 3 years ago | (#34868864)

Because he probably couldn't manage it? ;)

Re:Offensive (2)

h4rr4r (612664) | more than 3 years ago | (#34868870)

How come you never age?

If you are going to troll like this try aging your character.

Re:Offensive (1)

Anonymous Coward | more than 3 years ago | (#34869096)

From the article:

"This approach is so easy a grandmother could use it"

As a 49 yo grandmother, feminist, and C programmer I find that offensive. Why not a grandfather ?

They're too busy bitching about the demise of COBOL and how we wrote an entire system in 2KB

Re:Offensive (1)

Anonymous Coward | more than 3 years ago | (#34869270)

Your case will break if you continue to enum your characteristics while being so volatile. Do switch to decaf else you won't be able to relax, for I am about to pass you an extern long double with a sizeof eight, making a perfect union between signed and unsigned types. Then I'm gonna roll-over and goto sleep.

Re:Offensive (2)

operagost (62405) | more than 3 years ago | (#34869666)

Because human beings have two sexes, so we have to choose one?

Re:That's silly. (0)

Anonymous Coward | more than 3 years ago | (#34868828)

And keyboard manufacturers who provided keyboards to "hackers" who guess manually.

Re:That's silly. (0)

YrWrstNtmr (564987) | more than 3 years ago | (#34869070)

The same role that Ford Motor Company is responsible to fill in preventing the use of it's vehicles as Getaway cars from scenes of crimes.

I think it's slightly different. Once Ford sells a car, they are done (except for warranty work).
This is more like Ford providing assistance during the heist. The robbers are actively using the service in the commission of the crime.

Also, the type of car is irrelevant. Or no car at all. Cracking the WPA in this instance can't be done without using Amazons service.

Re:That's silly. (1)

frosty_tsm (933163) | more than 3 years ago | (#34869202)

The same role that Ford Motor Company is responsible to fill in preventing the use of it's vehicles as Getaway cars from scenes of crimes. I think it's slightly different. Once Ford sells a car, they are done (except for warranty work). This is more like Ford providing assistance during the heist. The robbers are actively using the service in the commission of the crime. Also, the type of car is irrelevant. Or no car at all. Cracking the WPA in this instance can't be done without using Amazons service.

This would be like Ford giving road-side assistance during a heist. The tow-truck guy doesn't know the occupants are criminals, but if they see 20 bullet holes, a bleeding guy in the back, and maybe some curious looking bags... reporting it is simply being a good citizen.

Note the difference between Ford's tow-truck driver reporting what he saw and Ford monitoring all cars looking for those leaving a bank in a hurry.

Re:That's silly. (2, Interesting)

Anonymous Coward | more than 3 years ago | (#34869354)

This would be like Ford giving road-side assistance during a heist.

No, it's like Jared Loughner taking a taxi to the site of his shooting spree:

http://www.nytimes.com/2011/01/11/us/11taxi.html?partner=rss&emc=rss [nytimes.com]

The taxi driver is just providing his usual service at his usual price and has no indication that a crime is going to be committed.

Similarly, Amazon knows you're doing a lot of heavy computation, but that is one of the reasons someone would use Amazon EC2.

Re:That's silly. (1)

vux984 (928602) | more than 3 years ago | (#34869228)

I think it's slightly different. Once Ford sells a car...

So then its more like a rental car, if I'm a white hat cracker.

And I expect it will be like a stolen rental car if I'm black hat and steal someone elses amazon account / credit card to get access.

After all crooks typically use "fraudulently obtained" getaway cars too. So even if meticulous records are made for each car they aren't generally all that useful.

Re:That's silly. (1)

Surt (22457) | more than 3 years ago | (#34869254)

Like using the GPS to help them find a good route to their getaway destination.

The article is 100% wrong about the availability of gpu instances. So this is definitely possible without Amazon's service. Amazon's service is just making it cheaper.

Re:That's silly. (3, Funny)

Applekid (993327) | more than 3 years ago | (#34869204)

"what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

The same role that Ford Motor Company is responsible to fill in preventing the use of it's vehicles as Getaway cars from scenes of crimes.

Eh, more like the same role that a chauffeur is responsible to fill in preventing the use of it's driven vehicles as getaway cars from scenes of crimes.

After all, once Ford makes a car they're done, right? EC2 is continually crunching numbers until it's cracked.

Re:That's silly. (0)

Anonymous Coward | more than 3 years ago | (#34869274)

Explain the wikileaks incident then.

When that happened, what they stated was something along the lines "we don't agree with what wikileaks is our resources". Logic follows, if they don't shut down any other kind of activity, then it means they're actively condoning it.

Re:That's silly. (1)

GeneralSecretary (1959616) | more than 3 years ago | (#34869298)

"what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

The same role that Ford Motor Company is responsible to fill in preventing the use of it's vehicles as Getaway cars from scenes of crimes.

Actually some car companies have systems to slow down cars remotely if they are in a police chase. Perhaps Amazon should then slow down servers that the police inform them are involved in illegal activities?

Re:That's silly. (1)

icebraining (1313345) | more than 3 years ago | (#34869460)

They probably stop them altogether - it's against their ToS to use the services for unlawful purposes.

Re:That's silly. (0)

Anonymous Coward | more than 3 years ago | (#34869466)

Perhaps Amazon could just update its TOS to say that the use of GPU's to defeat encryption methods is not allowed. Then if they found out or it was reported they could just cancel his account.

Re:That's silly. (3, Insightful)

Bert64 (520050) | more than 3 years ago | (#34869714)

There are perfectly legal reasons for cracking encryption...

Data recovery (eg forgotten passwords)
Security auditing
Crypto development (ie stress testing)

Re:That's silly. (1)

operagost (62405) | more than 3 years ago | (#34869468)

Fords are being used to commit crimes? Clearly, the US government should step in to stop this. Ford must either allow severe regulation, or face a mandatory takeover. By the way, this has nothing to do with the federal government owning GM.

Re:That's silly. (1)

Reverand Dave (1959652) | more than 3 years ago | (#34869592)

Agreed, that's like getting after adobe because someone used their Acrobat X to write a ransom letter or published a snuff film in .FLV format. If the users are violating the ToS then the company has a right to suspend service, but I don't think it is their responsibility to guess at it's users intent before they have actively violated the ToS.

Re:That's silly. (1)

makubesu (1910402) | more than 3 years ago | (#34869746)

Why shouldn't Amazon do their part? Shouldn't companies try and protect the environment they do business in? Companies have higher obligations than to just make money. Granted, I doubt there is anything they could do, much as there's nothing Ford can do to stop their cars being used in heists. But if they can, they should.

Amazon should encourage it. (1)

chrisj_0 (825246) | more than 3 years ago | (#34868780)

cracking an encryption key is not a crime. Using a cracked encryption key to seal data is a crime, and that hasn't changed.

Re:Amazon should encourage it. (1)

hedwards (940851) | more than 3 years ago | (#34868888)

Technically speaking, they would be in for conspiracy. Allowing it because they aren't monitoring the use would probably be alright, but encouraging it would definitely make them liable, at least in part, for any criminal acts that they're involved with.

Re:Amazon should encourage it. (0)

Anonymous Coward | more than 3 years ago | (#34869052)

they are not in for conspiracy, since that would require actual specific knowledge and cooperation. They may however be civilly liable for negligence. That would depend on the cost required to monitor.

This would be incredibly difficult to prove, since you would need to assume they have some valid way of knowing which uses are ilicit and which are not, and there may be perfectly legitimate reasons to be running such crunching. (Such as the researcher in the OP, or code braking challenges)

Wonder how safe longer keys are... (2)

mlts (1038732) | more than 3 years ago | (#34868786)

I wonder with the ways that WPA2-PSK is being eroded, if one should just go with 30+ character long keys. TrueCrypt always recommends to go with 20+ character passphrases and since there isn't much key strengthening with WPA2-PSK, a longer key is a good thing here. My preference is to use a 63 number of letters and digits, and if it gets forgotten, just generate another string and paste it into the router from a machine on the wired network.

Re:Wonder how safe longer keys are... (1)

2.7182 (819680) | more than 3 years ago | (#34868926)

I think you point is a good one. Basically, as key lengths get longer for most cryptosystems, the brute force time required grows exponetially (? - or really fast). So I think that this kind of issue, which comes up a lot in tech news lately, can be squashed by making a key length which is not unreasonably long. RSA for example is just not going to be beaten this way. If you find a parallel resource to factor 150 digits numbers, it probably isn't going to be able to handle 200 digit numbers. (Or maybe even 155 digits numbers...)

Re:Wonder how safe longer keys are... (2)

Carnivorous Vulgaris (1964964) | more than 3 years ago | (#34869236)

Charecter set ^ password length = permutations.
You're right with exponential growth.

Just remember that if your password has password dictionary fragments, including all common substitutions, then the length is the number of fragments, not the number of characters.

20-character (5, Informative)

Lord Ender (156273) | more than 3 years ago | (#34868976)

It's actually 20 random characters that are recommended for use as cryptographic keys. The reason for this is that 20 random keys from the US keyboard has the same number of possible combinations as 128 random bits. If you use anything less than 20 random characters, even if you use a 128-bit encryption algorithm, you won't have 128-bit encryption. The same is true if you use 20 non-random characters. A brute-force attack would try passwords with words or phrases before going for the really random stuff, so you again don't have 128bit encryption.

Also fun to realize: for every character less than 20, you lose 100x your security. A 19-character password could be cracked in just 1% of the time of a 20-character password. A 10-character password would take .000000000000000001% of the time.

That's not correct (1)

Sycraft-fu (314770) | more than 3 years ago | (#34869218)

Reason is the key you provide isn't used directly on a competent cryptosystem. It takes a hash of the key. So the key is always the requisite number of bits for the system, even if it is actually too long or too short.

Now you are correct in that shorter keys are faster to crack, however in a system like that you can't just straight out brute force the raw keys. You have to take the passwords, hash them, then test that. That takes longer.

Re:That's not correct (2)

Carnivorous Vulgaris (1964964) | more than 3 years ago | (#34869386)

Not always. [wikipedia.org]

Access points use the SSID as the salt, and most APs use common default SSIDs.

Re:That's not correct (1)

icebraining (1313345) | more than 3 years ago | (#34869558)

Not here - most people get their routers from their ISP, and they generate a new SSID for each (ISP name + 4 alphanumeric characters).

Re:That's not correct (1)

Bert64 (520050) | more than 3 years ago | (#34869770)

If you know the source password is less than a certain length (ie less than the keysize), then thats what you attempt to brute force instead of the derived key... Go for whichever (actual key, source password) has the least possible combinations.

Re:20-character (1)

pjt33 (739471) | more than 3 years ago | (#34869600)

There are some fairly notable error margins in your figures. Taking the claim that 20 characters have 128 bits of entropy, we get a character set of size 85, which is plausible (a-zA-Z0-9 plus 23 punctuation marks), but then each character less than 20 loses a factor of 85 rather than 100, and reducing by 10 characters has one fifth of the impact on the key space that you calculate.

I personally prefer to stick to alphanumerics, avoiding oO0iI1S5Z2. 23 characters gives me more than 128 bits of entropy.

Re:20-character (1)

petteyg359 (1847514) | more than 3 years ago | (#34869966)

It's actually 20 random characters that are recommended for use as cryptographic keys. The reason for this is that 20 random keys from the US keyboard has the same number of possible combinations as 128 random bits.

26 letter keys + 10 number keys + 8 symbol keys * 2 shift keys = 88 characters.
2^128 = 128 bits ~= 3.40e38
88^20 = 20 characters ~= 7.76e38
88!20 = 20 unique characters ~= 7.48e37

128 bits do not have anywhere near the same number of possible permutations as 20 US keyboard characters. None of the above has anywhere near the permutations a 2048-bit RSA key has (~3.23e616), either :)

Re:Wonder how safe longer keys are... (1)

Carnivorous Vulgaris (1964964) | more than 3 years ago | (#34869126)

If you use a 63 character, full ascii key, which is quite realistic since this is a key, not a password, then the time quickly rises to galactic scales.

Crisis averted.

Re:Wonder how safe longer keys are... (3, Funny)

ikkonoishi (674762) | more than 3 years ago | (#34869260)

I hear that Chuck Norris just uses his name as the key. When anyone tries to crack it their computer catches fire.

Re:Wonder how safe longer keys are... (1)

jack2000 (1178961) | more than 3 years ago | (#34869614)

It realizes the futility of it's existence and chooses to self terminate before Chuck Norris roundhouse kicks the entire apartment block, house cul-de-sac.

Re:Wonder how safe longer keys are... (2, Interesting)

Anonymous Coward | more than 3 years ago | (#34869306)

This link has the actual test http://stacksmashing.net/2010/11/15/cracking-in-the-cloud-amazons-new-ec2-gpu-instances/

Which looks like a single dual fermi EC2 instance gets 250M hashes/sec which is crazy. So assuming you have a 100 instance cluster of them:
40 bits of random : 43 s (~ 8 chars)
45 bits of random: 23 mins (~9 chars)
50 bits of random: 12 hours (~10 chars)
64 bits of random: 23 years (~13 chars)

Better start using pwgen 14 for your passwords.. For WPA-PSK I actually use this:

$ python
>>> import base64
>>> base64.encodestring(file("/dev/urandom").read(128/8));
'HZE6Ka6GeO3OT23ay2G0Ww==\n'

Which isn't going to be reversed without breaking sha1.

Re:Wonder how safe longer keys are... (1)

AHuxley (892839) | more than 3 years ago | (#34869932)

Thanks for the code, finally a use for terminal in OS X :)
I wonder if it gets logged? Get the main computer and read the logs for much the crypto used?

Re:Wonder how safe longer keys are... (1)

operagost (62405) | more than 3 years ago | (#34869610)

This article is about WPA, not WPA2. WPA2 uses all of 802.11i and includes AES.

crime? (0)

Anonymous Coward | more than 3 years ago | (#34868788)

Cracking WPA != crime

Re:crime? (1)

hedwards (940851) | more than 3 years ago | (#34868924)

It's not a crime the same way that picking locks isn't a crime. But that doesn't mean that if you're the one picking the locks that the cops are going to consider you an innocent bystander either. Legally, Amazon might be in the right for looking the other way as people do this, but that doesn't mean that they aren't going to suffer the consequences when/if somebody uses their equipment to break the law.

Re:crime? (1)

Mysteray (713473) | more than 3 years ago | (#34869022)

Amazon doesn't know what the computations taking place on the CPUs/GPUs they lease are doing.

They could be searching for oil deposits, searching for radio signals from ET, recovering lost keys for a legitimate owner, for law enforcement, or for bad guys. They could be doing several of those things simultaneously and it would take very time consuming, deep, by-hand expert research to try to figure it out and you'd still never be sure you understand what all the numbers mean.

Amazon probably doesn't even know when someone installs a web server or a database on an EC2 node. They certainly don't know whether or not it's used to host material leaked from govt sources legitimately into the public domain or who and who isn't a journalist.

That doesn't seem to stop them from selectively applying their ToS at the request of the likes of Sen. Lieberman.

Re:crime? (1)

HeronBlademaster (1079477) | more than 3 years ago | (#34869280)

They certainly don't know whether or not it's used to host material leaked from govt sources legitimately into the public domain or who and who isn't a journalist.

They don't, unless that customer trumpets their use of the service in that manner to the world...

Re:crime? (1)

Mysteray (713473) | more than 3 years ago | (#34869446)

That's a very good point.

I tend to think of someone's use of EC2 as public info, only a "whois" away.

Security researchers like to use EC2 because it's cheap, and it's hard to block network scans from since it shares a netblock with other mission-critical stuff like, say, Twitter.

It's likely that industry journalists would have made a big deal about Wikileaks using it had they not pointed it out themselves.

I still can't tell if this is a keyword placement-piece for EC2 or if somebody really does think this is novel research. ISTR hearing there is an upcoming BlackHat presentation (and that BlackHat was owned by a media company too).

Amazon ought to be extremely careful about playing politics with its ToS and safe harbor provisions.

Re:crime? (1)

Thud457 (234763) | more than 3 years ago | (#34869744)

it's hard to block network scans from since it shares a netblock with other mission-critical stuff like, say, Twitter .

OMGWTFBBQROFL!

Re:crime? (1)

Opportunist (166417) | more than 3 years ago | (#34869098)

Excuse me? Since when is the maker of a tool liable for its misuse? Did they change a law when I, Smith and Wesson were not looking?

No role (0)

Anonymous Coward | more than 3 years ago | (#34868792)

This is like asking, "What role should auto manufacturers take to prevent people from using cars to commit crimes?" No role! It's not the object, it's the person and the actions they commit.

Re:No role (1)

mini me (132455) | more than 3 years ago | (#34868880)

Tell that to Napster.

Re:No role (1)

Opportunist (166417) | more than 3 years ago | (#34869120)

Every time we talk about sensible law someone comes in with a counter example out of the area of copyright and patents.

Please, in case you haven't noticed yet, the insanity in copyright and patent laws is only rivaled by sex laws. Let's hope at least the rest of the legal codex at least retains a bit of reason and connection to reality.

Wikileaks (5, Insightful)

Sub Zero 992 (947972) | more than 3 years ago | (#34868794)

Amazon provide infrastructure services. They need not, should not, must not know or seek to know how these services are used.
Oh wait, Wikileaks...

Re:Wikileaks (2)

TheCarp (96830) | more than 3 years ago | (#34869082)

You forgot one.... cannot.

Firstly, they can't, reasonably audit all code going into the system by hand. This leaves some sort of automated code check, or monitoring the workloads in some way. Simple size of the workload doesn't help, that could be anything.

You could watch for library calls to hash functions but, they are easy enough to implement and get around that.

Even if you could detect the fact that I am hashing strings over and over again, you still wouldn't know why I was doing it. Am I researching hash functions? Am I processing bitcoin transactions (probably not an economical use), am I strength checking my own password? A groups passwords?

Hell I worked as an admin at another job. I was called into another admin's office one day to be shown a jumble of characters on his white board.... in the middle of them was my password. He had been tasked with strength checking all of our passwords.I was surprised that he got mine, but, in thinking about it later, it was close enough to being based on a couple of dictionary words that it wasn't very good.

Re:Wikileaks (0)

Anonymous Coward | more than 3 years ago | (#34869290)

They need not, should not, must not know or seek to know how these services are used.

Why? Because you say so? So then you'd also agree that I can do with your property however you want and you have no right to monitor how it's being used?

None? (5, Insightful)

kju (327) | more than 3 years ago | (#34868810)

They should not take any steps in this direction. We should have learned that. it. just. don't. work. Brute-forcing a hash is not illegal anyway. If the customer of amazon decides to misuse the result, than this is not the responsibility of Amazon. Many services and tools can be abused for crime.

Re:None? (1)

noidentity (188756) | more than 3 years ago | (#34869694)

I think they should be required by law to only process non-evil bits. The implementation is trivial: just add an extra "evil" bit to every bit.

Easy answer (4, Insightful)

betterunixthanunix (980855) | more than 3 years ago | (#34868812)

what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

No role whatsoever; let law enforcement agencies handle criminal investigations.

Re:Easy answer (1)

LWATCDR (28044) | more than 3 years ago | (#34869004)

If you criminalize super computers then only criminals will have super computers.
I mean really people. I can buy guns, knives, and cars off of which can be used in crimes. I do not see anyone suing Glock.

Re:Easy answer (1)

spong (32007) | more than 3 years ago | (#34869054)

No role whatsoever; let law enforcement agencies handle criminal investigations.

Is anyone here really comfortable with Amazon in the role of policeman? Hmm?

Well I Can Answer the Last Question (4, Insightful)

BJ_Covert_Action (1499847) | more than 3 years ago | (#34868816)

Among the questions Roth's research raises is, what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

None whatsoever. Amazon and other service providers are retailers. They are not a police force. If a crime is being committed, let the designated authorities (i.e. cops) investigate it, police it, and arrest the criminal. No business should ever be involved in policing anything. That's a role specially held for the executive branch of governments.

Re:Well I Can Answer the Last Question (0)

Anonymous Coward | more than 3 years ago | (#34869272)

I'm inclined to agree in principle--but if they don't cooperate at all, we'll likely end up with more situations comparable to the FBI Dallas Datacenter raids. I agree any good DR plan should include contingencies for even police raids... but it shouldn't be the expected and likely case. Unfortunately--with cloud computing and the amazon model--the odds of sharing a CPU with a criminal is... fairly likely. The odds of sharing a data center with a criminal are virtually 1/1. If amazon resists (even legally), I find it highly probable that some jackbooted asshole will eventually decide to get a warrant for *everything* and start driving it all away in a long line of SUVs for weeks at a time.

While amazon doesn't have a legit role...socially...Well...I think we have to admit they have some role in practice--or will.

Re:Well I Can Answer the Last Question (1)

BJ_Covert_Action (1499847) | more than 3 years ago | (#34869794)

While amazon doesn't have a legit role...socially...Well...I think we have to admit they have some role in practice--or will.

No, they don't have a role. If the police, or FBI, or whoever need access to Amazon's resources to prosecute a legitimate criminal that is likely using Amazon's services for criminal activity, then said police entity needs to obtain a legal warrant just like they do for anything else. If the warrant is obtained legally, then Amazon, by law, must comply with the warrant and turn over all data required by the warrant. That is fine. That is legal. That is how the system is supposed to work. If Amazon resists police investigation of Amazon's computational resources after the police have obtained a legal warrant, then Amazon is on the hook for legal prosecution by their own action.

Any deviation from this model is an infringement on the rights protected under the 4th amendment of the Constitution. Any deviation from this model further corrupts the justice system, as well as industry. If you give a profit motivated company the power of execution over it's customers, then they are no longer customers, they are servants. No privately held company should ever have the power of execution over an individual. If they want to refuse service, that is fine. Amazon is not required to provide their services to everyone by law. However, once they allow a customer to exchange legal tender for a service or good rendered, they do not gain the power to police or otherwise execute that individual's actions. They are welcome to terminate services and return whatever fees are necessary to the customer. But policing in any manner, voluntarily leaking private information to government authorities, or sharing of data not explicitly outlined in the business contract is an abuse of the law, the justice system, and the spirit of business between customers and service providers.

Why use EC2? (1)

jonescb (1888008) | more than 3 years ago | (#34868820)

How much time does this take to do on a home computer using the same GPU acceleration? I know that Amazon has tons of computing power, but you're not the only one using it. Why spend $1.68 to crack a key when I can do it for free in the same amount of time on the PC I already have.

Re:Why use EC2? (1)

betterunixthanunix (980855) | more than 3 years ago | (#34868868)

Last I checked, a high end GPU costs quite a bit more than $1.68, and if you are just going to crack a few WPA keys, why would you want to spend so much money?

Re:Why use EC2? (1)

Bert64 (520050) | more than 3 years ago | (#34869878)

Because many people already have such GPUs for playing games, and yet very few people play games 24/7...
It's quite feasible that someone could play games during the day, and let their GPU do cracking at other times.

Re:Why use EC2? (2, Insightful)

natehoy (1608657) | more than 3 years ago | (#34868986)

"In the same amount of time" is the biggie. They are talking about using short timeslices of hundreds of computers. The article mentions using 400 GPUs (but isn't very clear on whether 400 GPUs for 20 minutes is what costs $1.68). If that's true, then decoding it with a single GPU would take about 5 1/2 days, assuming you had the same class of hardware Amazon is using.

Not earth-shattering amounts of time, true, but if speed is of the essence you probably don't want to wait the better part of a week.

Re:Why use EC2? (1)

AHuxley (892839) | more than 3 years ago | (#34869980)

"don't want to wait the better part of a week." Trailer park, hotel, holiday .. 20 minutes is great. In a week you might be back home :)

Re:Why use EC2? (0)

Anonymous Coward | more than 3 years ago | (#34869030)

This is the stats of one instance for the GPU

22 GB of memory
33.5 EC2 Compute Units (2 x Intel Xeon X5570, quad-core “Nehalem” architecture)
2 x NVIDIA Tesla “Fermi” M2050 GPUs
1690 GB of instance storage
64-bit platform
I/O Performance: Very High (10 Gigabit Ethernet)

this is a little more powerful than your average desktop.

Re:Why use EC2? (1)

jonescb (1888008) | more than 3 years ago | (#34869192)

I think the 2x Teslas is the only thing in those stats that are really necessary for cracking keys. You don't need any fancy networking, or tons of data storage and probably not that much RAM. If the cracking is all GPU accelerated, the need for two high end CPUs is questionable. With that said, Teslas are indeed pretty expensive.

Re:Why use EC2? (1)

Wingman 5 (551897) | more than 3 years ago | (#34869224)

for normal cluster computing you want high IO between instances (doing some math this guy was running 8 of these instances to get the numbers he was achieving, so to answer the grandparent, you would need to buy 16 Teslas to get the performance he is getting)

Re:Why use EC2? (1)

MichaelKristopeit337 (1967528) | more than 3 years ago | (#34869068)

EC2's power doesn't come from the individual pieces of consumer grade hardware it utilizes... it comes from the vast parallelization of thousands of pieces of such hardware, all linked together through an API layer exposed to anyone with a credit card.

Re:Why use EC2? (4, Interesting)

volsung (378) | more than 3 years ago | (#34869606)

The assertion that high end Tesla cards (often $2k) are required for this crack is nonsense. In terms of integer, single precision floating point and memory bandwidth, a GTX 580 is actually FASTER than the most expensive Tesla card. Tesla cards have better QA for 24/7 usage, 4x faster double precision floating point, and 3 or 6 GB of memory, plus some other occasionally useful features. But anyone with an NVIDIA SLI gaming rig built in the last 2 years could easily have done what this guy did in less than 20 minutes.

None (1, Redundant)

Microlith (54737) | more than 3 years ago | (#34868832)

They cannot arguably be capable of defining what actions being taken with an EC2 instance are and are not crimes, therefore they should not even attempt to do so. It is not, after all, their duty to do so.

They can refuse service to those who they feel are suspicious, or cut people off if they violate some generic ToS, but surreptitiously cutting in because they think someone is committing a crime (and cracking WPA is not a crime), only runs them the risk of false positives.

More importantly, if they really feel they are observing someone committing a crime using their service, they should stand back and report it to authorities, who (in varying degrees of accuracy) are charged with being capable of determining if a crime is taking place and have the authority to intercede.

Le Gasp (1)

Even on Slashdot FOE (1870208) | more than 3 years ago | (#34868838)

You can buy computer time to compute things! What will they think of next!

None. (1, Redundant)

harl (84412) | more than 3 years ago | (#34868852)

Breaking news! Tools can be used for anything!
Do you require pre-approval to use a hammer since it can be used to kill someone? What about the knives in your house?

Just like the phone company they should pay no attention to what their systems are being used for.

Trying to police it is a waste of resources. They start looking then people will start obfuscating the data. If I send you a big pile of data in no noticeable format (since I've grabbed only the stuff I need and catted it together) and a bunch of code it's going to take you a lot longer than 6 minutes to figure out what it does. Once you do figure it out then what's the point work has already been done?

Re:None. (1)

thePowerOfGrayskull (905905) | more than 3 years ago | (#34869078)

Breaking news! Tools can be used for anything! Do you require pre-approval to use a hammer since it can be used to kill someone? What about the knives in your house?

Guns, cars, and just about anything else that provides an "obvious" means of inflicting harm on others fall into the same category, but undoubtedly-well-meaning folks always manage to get them regulated.

Prevention or Reaction? (1)

southpolesammy (150094) | more than 3 years ago | (#34868906)

I'm not certain how Amazon would be able to prevent such activity before it happened, aside from code snooping, which is probably in violation of the terms of their services agreement. Perhaps profiling would be in order before accepting someone as a customer, but how would you protect yourself against shell companies acting on behalf of a known abuser? Rather, I think the question should be "how quickly can Amazon react when this occurs".

ISP's and hosting providers have had to face similar situations for almost a couple decades now, and I would think that they'd be the logical entities for Amazon to consult with re: the mitigation of illegal activities using their cloud as an attack vector.

This is so not news. (1)

Mysteray (713473) | more than 3 years ago | (#34868930)

Someone took a password-guessing program and ran it on EC2. Big freaking deal.

EC2 now offers GPUs. Someone took a GPU-based password-guessing program and ran it on EC2. Big freaking deal.

True, raw SHA-1 used all by itself is not the thing to generate password hashes with, but this is not a weakness in SHA-1. As the researcher says, it shows merely that SHA-1 is efficient.

SHA-1 is not weakened, broken, or exploited in this research (it is significantly broken in other ways though).

Teams were guessing passwords with GPUs Defcon last year. They were guessing passwords with EC2 last year, too. The combination is not novel or innovative.

This reads like Marketing placement to me.

Re:This is so not news. (1)

MichaelKristopeit337 (1967528) | more than 3 years ago | (#34869242)

you haven't heard?

slashdot = stagnated

What about LED "wireless" networks? (1)

countSudoku() (1047544) | more than 3 years ago | (#34869112)

Oh, about 6 seconds for that security travesty, I reckon. 4 seconds, if setup by faulty Windows Admins.

HA! Mr. T is still laughing at you, only harder this time.

The pricing is wrong (1)

Wingman 5 (551897) | more than 3 years ago | (#34869168)

Either the guy is lying or the pricing is wrong, from the TFA is says they charge 28 cents a min, but from the amazon ec2 pricing page it says [quote]Pricing is per instance-hour consumed for each instance, from the time an instance is launched until it is terminated. Each partial instance-hour consumed will be billed as a full hour.[/quote]

also to get 28 cents/min you would need to run 8 instances at $2.10/hour so really he paid $16.80 not $1.68

What role should they take? None, maybe? (3, Insightful)

Opportunist (166417) | more than 3 years ago | (#34869182)

I would expect Amazon to cooperate with the law enforcement should they discover that their service was abused to commit a crime. But why should they required to "avoid" it? And most of all, how? The only way to really keep people from using that service for criminal means would be to explicitly disallow certain uses and then monitor whether it is used this way. And that in turn raises a question: How? Because one of the core reasons this service is interesting is that it offers cheap calculation power. If you attach a metric ton of red tape and surveillance, it's most likely cheaper and faster to let your old Pentium do it.

Hands Off (2)

b4upoo (166390) | more than 3 years ago | (#34869200)

Cloud services need to avoid any type of actions that create the illusion that they may be responsible for what users do. As long as they never have any editing of any uses of their product they will probably not be held liable by the courts. In a way it is like the truck driver that opens the trailer door and sees what he is delivering. As long as he does not know what is in the trailer the law will not charge him with transporting illegal or stolen items. Intent and knowledge are locked together. Don't look, don't see and don't know.

Math... (1)

Kymermosst (33885) | more than 3 years ago | (#34869212)

... is not a crime!

Re:Math... (1)

enrevanche (953125) | more than 3 years ago | (#34869424)

No problem, the newly elected house of representatives can fix that.

WPA, not WPA2 (1)

MobyDisk (75490) | more than 3 years ago | (#34869314)

Legacy WLAN hardware (1)

tepples (727027) | more than 3 years ago | (#34869918)

Are you offering to bankroll an upgrade to all deployed products whose WLAN hardware lacks WPA2 support? I didn't think so.

Sensationalism as usual... (0)

Anonymous Coward | more than 3 years ago | (#34869362)

NP? For fun, let's take a game that is entirely solvable, like chess... Tell me, using all the EC2 instances, who wins in the end at chess?

Wait, what!? You don't have enough EC2 instances to do that right? Oh... I see, you don't even have enough atoms in the universe to build a machine that would be able to answer that (using our current understanding of math/comp-sci/physics/etc.).

Use bigger keys, understand what combinatorial explosion means and GTFO with your sensationalism.

Nothing to see here besides my typos and grammatical mistakes, move along.

A simple solution (1)

jpiratefish (1690054) | more than 3 years ago | (#34869366)

One simple solution I can see for this is forcing a certain amount of up time on the servers to avoid charges that make short-use less desirable. An example - if I want to spin up multiple parallel servers for 1 hour each, I can get 10 servers for a few dollars. That's a blink in terms of usage, but a lot of power for a short time - there's IO, provisioning, transfer, Etc., and real costs incurred on Amazon's side of things - and in terms of payback, Amazon probably makes more money if those 10 servers stay online for at least a couple-hours each. If someone makes a server run for short burns, they could employ a simple grace system - you get 4 systems an hour, and then get charged $1 for each create/shut performed unless the systems stay up in excess of 4 hours. This way, folks can feel their way in as newbs without taking a hit, but abuses could then pay a premium for doing things with behaviors that appear to be more malicious than kindly. Something along those lines could curb abuse - but I must agree with other folks' posting to some extent - it's not Amazon's place to enforce proper Internet behavior. Profiting from a slightly less abusable pricing model is probably the way to go - as long as they don't kill their customers or send business away.

easy answer: none whatsoever (1)

justdrew (706141) | more than 3 years ago | (#34869438)

it's not their place to police how it's used. nor is it possible to do so.

This is wildly overstated as a risk (4, Interesting)

igb (28052) | more than 3 years ago | (#34869480)

The basic story is slightly hysterical. Firstly, WPA2 does use a multiple-iteration key derivation function. Secondly, even with the claimed performance, he can only "brute force" five or six characters, depending on the character set in use. It's enough performance to deal with dictionary words, because, indeed, it's a dictionary attack. But even at 400K password derivations per second (ie 400M SHA-1 hashes per second), eight random characters drawn from the 96 character printable ASCII repertoire are going to take 571 years to perform a brute force attack on, or an average time to success of 285 years. Don't like the odds? My home network uses 12 characters drawn from a 64 character set (ie base 64 encoding), which needs 374 million years (average 167 million) at that performance. Do I give a shit if that number gets reduced by a few orders of magnitude? Not really: I can always move to 15 characters...

Re:This is wildly overstated as a risk (2)

Mysteray (713473) | more than 3 years ago | (#34870000)

The great majority of passwords don't have anywhere close to the entropy of "eight random characters drawn from the 96 character printable ASCII repertoire". Probably a great many passwords can be successfully guessed in a reasonable amount of time at 400K trials per second.

here [korelogic.com] are the results from the last Defcon 18 contest.

WHITE HAT ?? THAT SHOULD BE SLAVE OWNER HAT !! (-1)

Anonymous Coward | more than 3 years ago | (#34869508)

Because fair is fair after all !!

Re:WHITE HAT ?? THAT SHOULD BE SLAVE OWNER HAT !! (-1)

Anonymous Coward | more than 3 years ago | (#34869910)

No, no. It's Plantation owner, who happens to have non-paid workers. Sort of like, well, open source. Nothing wrong with that.

Depends on Who You Ask (5, Funny)

carrier lost (222597) | more than 3 years ago | (#34869556)

...should Amazon and other public-cloud service providers [be liable for] customers [...] using their services to commit crimes?

  • MPAA/RIAA - If it aids in file-sharing, then Amazon should be charged $6M for each infringement
  • Washington - If it aids in leaking US data, then Amazon should be "extraordinarily rendered"
  • Wall Street - If aids the banks in looting the world's economies, then Amazon should get a $300M bonus.

Hope this helps...

The problem is not EC2 (2)

gweihir (88907) | more than 3 years ago | (#34869762)

The problem, as one of the referenced articles points out ans as has been known in the crypto-community for a long time, is fast key-derivation functions. Even the original UNIX password encryption function already took that into account and iterated the key derivation function to make attacks take longer. Typical methods used today for example iterate a second or so on the target CPU. This is a compromise between needing one second per unlock and requiring one second per brute-force attempt on an equivalent CPU. GPUs still make that attempt problemantic, but one application of SHA1 takes something like 0.1 microsecond on a modern CPU, so it should at least be iterated 10'000'000 times or so. Even with that, SHA1 is a bad choice, as it is too simple. Use something that requires a full-blown CPU to work and that a GPU cannot easily do. Of course, high-entropy passwords also help a lot by enlarging the search space.

But in essence, EC2 GPU instances can only break Crypto for cheap that was badly implemented anyways. That is not really a surprise. There are far too many people out there that do crypto without even understanding the attack possibility, let alone being cryptographers.

The same moronic reaction (1)

Un pobre guey (593801) | more than 3 years ago | (#34869842)

Make it illegal, and people will stop doing it.

That notion has universal appeal. It is simple enough that practically all voters understand it. It is compatible with most people's moral code, at least in principle. It lends itself very easily to law-and-order populism and electioneering, and of course anything that increases the use of police forces and prisons is popular with several major lobbying organizations. One problem, though: it only occasionally works. This is aside from any legal and civil rights issues associated with assigning liability to providers of goods and services who have no practical or conspiratorial relationship with the law breakers, and cannot easily be demonstrated to have shown negligence. Can anyone point out clearly relevant court precedent?

Really (1)

zmollusc (763634) | more than 3 years ago | (#34869898)

According to the back of this envelope, an eight digit upper case alphabetic key would take a worst case of $2436.32 for his algorithm to crack. What sort of shitty pre-shared key is he attacking? Or is my envelope wrong and I suck?

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?