Geo Tagged Cloud Zombies
The largest cloud computing environment in the world is run by crooks, and when you take Gartner's projection of 2013 SaaS (Software as a Service) revenues running at $16 billion (against Enterprise software at $300 billion) we are in for an interesting few years.
Rodney Joffe, Senior Vice President and Senior Technologist at Neustar, Inc (who offer directory and clearinghouse services to large and small telecommunications service providers), spelled out some amazing realities in his talk 'Cloud Computing for Criminals' at the recent Cloud Connect conference in Santa Clara California:
There are a few Powerhouse Cloud Providers on the planet: Rackspace have 75,000 systems, 150,000 CPUs and 400 Gbps Bandwidth... Amazon 160,000 systems, 320,000 CPUs and 500 Gbps bandwidth... and Google 500,000 Systems, a million CPUs and bandwidth at 1,500 Gbps.
But the black cloud dwarfing these providers is Conficker, a computer worm which targets the Microsoft Windows operating system to co-opt machines and link them into a 'virtual computer' that can be commanded remotely by its authors. The numbers are pretty staggering:
Conficker's zombie systems are at 6,400,000 and rising, controlling 18,000,000+ CPUs and 28 Terabits of Bandwidth across 230 Countries. This vast network of interlinked automatically collaborating computers are available for rent, and you can specify your geographies, networks, bandwidth, OS Version with no moral, ethical, or legal constraints.
These criminal services are typically used for DDoS, Spam, and Data Exfiltration (unauthorized release of data from within a computer system).
Against these amazing statistics I've been pondering the ever greater spread of geo location and information sharing by all manner of computer users. Ten years ago on the internet no one knew you're a dog, to quote the old New Yorker cartoon. These days many people are convinced the weak ties of FoaF (friend of a friend) connections enable us to learn all about people we befriend online. If we ever meet in the flesh we know all sorts of contextual information about each other, runs the popular thinking, and our huge networks of contacts - 'another five Twitter followers today!' - are the path to a 'personal brand' and greater influence.
The huge scale of Conficker's power, reach, targeting flexibility and use cases are likely to be paralleled by similar data mining by criminals on a large scale as more and more people share their details and location online in real time. It's one thing for a criminal to take advantage of an individuals' location details to break into their unoccupied house; the industrial scale of Conficker style manipulation make large scale breaches of information on a highly personal level pretty alarming.
It's very early days for the unprecedented level of open information sharing sophisticated new devices and applications have enabled. We have a long way to go before we can effectively filter the torrent of information that it's never been easier to tune into and join.
The privacy policy generation and consumer privacy dispute resolution industry has not kept pace with the rapid expansion of Our shared personal information on free-to-use internet services. (TRUSTe certifies Facebook for example, but few people appear to have heard of that company or know what it does out of the millions of Facebook users).
Sooner or later it's inevitable that the sheer depth and volume of rich personal information in these new services will be exfiltrated by criminals. How, why and where is an open question but it comes with the territory as the location tagging and associated information pickings get ever richer. Facebook zombies may be in your future...
Zombies from Shaun of the Dead