How Hackers Hid a Money-Mining Botnet in Amazon’s Cloud

Why exactly not? Amazon and probably Google cloud's IPs are probably available publicly, and you can probably discern Googlebot's IP from the cloud ones (using user agent, or even ip ranges). You can sensibly block IP ranges from any dedicated hosts/cloud providers. Only <1% of them would be valid traffic (ie someone working in AWS going to your site directly)

I recall, when I signed up for my free year of AWS, that it required a valid credit card. They claimed to only target providers that need essentially only an email address.

I think that detail makes the title incredibly misleading.

I see nothing ethically wrong with this. As long as companies offer a free trial, they should consider the risk that users will take advantage of it to do anything that can be done on a computer, whether that means running proxies, scrapers, or miners.

The only plausible issue here is that the "hackers" automated the process, meaning they have no intention to actually convert into paid customers. But surely the companies account for the risk of free trial users not converting to paid. That's the whole point of a free trial.

The only way to mitigate this is to require a credit card up front for the free trial, which IIRC has been shown to reduce conversions. It's likely that reducing conversions by requiring a credit card will cost companies more than they lose from automated scripts signing up to their service. (And by the way, a CAPTCHA will be futile here -- the bots are only signing up to a few dozen accounts, so the "hackers" can manually solve the CAPTCHAs or farm each out to Pakistan for fractions of a cent.)

Back in my "blackhat SEO" days, these kind of scripts were super common. Any minimally profitable process that can be automated, can and should be. Because when you scale $0.25/day across 1000s of accounts, suddenly you're making quite a bit more.

This is actually a great idea and I just might implement it myself. Come at me! ;)

They set up a litecoin mining botnet and out fear being detected - and more generally doing the right thing - shut it down / reduced it to only a few bots.... So it's not like they actively tried to hide it via some kind of rootkit or the likes...

I think http://www.gutenberg.org/ does the same.

What should we do then?

I am not familiar with bitcoin so I can't say exactly how to defend it other than just say block certain tools at least.

Any site providing service to run user code is always vulnerable to code execution abuse, and this is where sandbox and strict job execution policy (job timeout, system call prohibitions, whitelist approach etc) are required. But that will degrade the service's usefulness. Obviously reading /etc/passwd should return permission denied or at least returns nothing and any file creation is restricted to local sandbox.

I'd like to ask people from codeacademy and coursera to reveal a bit more about their security policy. You can build your own rainbow table if they allow you to use the hash library, http request and sends request to remote service (with a digitalocean account you can pay $5 for 20GB SSD storage).

Solid comment.