Unless you’re really an IT security hawkeye, you probably missed the story a couple weeks ago about the Zeus botnet infiltrating Amazon’s cloud service. We noticed it because Backupify runs on the Amazon cloud service, so the reliability therein is of great concern to us. (This is why Backupify has plans to expand to a second cloud provider, so we can be redundant to multiple systems.)

In Amazon’s defense, the Zeus infection lasted only a few hours, had no major service impact,  and was the product of a lucky chain of events, rather a successful planned attack. But it brought up an interesting point: Infecting a cloud service is the holy grail for virus authors.

Malware botnets or zombienets are in effect jury-rigged cloud systems created by viruses. As the virus spreads through multiple systems, it enlists each system in a common cause. If any one PC is disinfected, the whole network is largely unaffected. But why go to the trouble of defeating multiple individual PCs when — if you can pull it off — subverting even a portion of a major cloud system gives you huge computing power and net bandwidth to play with?

How much damage could a denial of service attack incur with even one percent of Salesforce.com’s server power? How about a brute force password crack run by Microsoft’s Azure network? Or a phishing scam distributed by some subverted Amazon cloud account?

More importantly, what happens to the data stored in those virus-subverted cloud accounts? In the best case scenario, you simply lose access for the duration of the viral infection. Worse, all your data becomes infected with the virus, so anything you pull to your local machine becomes a carrier. And the doomsday scenario? The cloud provider has to permanently wipe some portion of your data to revoke the infection.

Who’s glad they have a Backupify account in those situations? Yes, we could ourselves be the victim of an Amazon takedown — which is why we’re looking into a second cloudstore — but you’ll be glad to have us when (not if) Facebook gets its first major infiltration.

Related articles by Zemanta

• Security experts advise self defense in the cloud (infoworld.com)
• Rackspace Says it Is Closing the Gap with Amazon (readwriteweb.com)
• Blue Ridge Networks Plugs Security Holes in Evolving U.S. Grid Infrastructure (prweb.com)
• A short history of cloud computing outages (macworld.com)