Resource Abuse

Resource abuse is the pattern of malicious actors leveraging the free offerings of products to obtain access to the generalized computing resources (compute, storage, and bandwidth) that are used to power the free service, and use it for their own purposes. This is best illustrated through some examples:

Video Hosting

The internet is full of illegal video hosting sites that are expressly designed and operated to illegally host copyrighted works. These sites require large volumes of storage and bandwidth to operate, but both resources are prohibitively expensive for operations like these to obtain through legal mechanisms, and more importantly, could serve as a vulnerability. If law enforcement knew the location of the physical servers these operations were run off of, it would provide an easier basis to take them down, and would provide ample opportunities to identify and prosecute the operators of these sites.

So rather than buying servers that they host these videos on, or purchasing these services from a cloud service provider, illegal streaming sites will try to find loopholes in the operation of platforms that allow them to use the storage and bandwidth of a major cloud service for free. 

A simple approach to this is to upload the videos to a site like DropBox, federated among a huge number of fake accounts, and have each video replicated to multiple accounts, so that if one gets taken down, another can be used. This approach enables the video streaming site to have their website just embed links to dropbox, switching between sources as necessary, and enables them to run a web-scale video hosting platform at a tiny fraction of the true cost that running such an operation costs.

Though this example is simple, as a veteran of this field, I can assure you that the lengths these folks will go to to get free storage and bandwidth is unbounded. When I worked on problems in this space I was amazed at the tenacity, inventiveness, and audaciousness of the abusers, who often would build complex systems that demonstrated they understood our systems as well as we (the company) did.

Chia Mining

Another common form of resource abuse is Chia Mining. Chia is a cryptocurrency that uses "proof of storage" rather than proof of work or proof of stake as its mechanism for generating value. This essentially means that the more storage that a user has read-write access to, the more money they can make. This sets up a challenge for any service that offers any amount of truly unpaid storage - if an attacker can find a way to create accounts automatically (and believe me they do), then they can scale up a chia mining effort to make an unbounded amount of the cryptocurrency.

Cryptocurrency Mining

While Chia is the easiest of the cryptocurrency mining efforts to understand, crypto-mining operations are a primary culprit of resource abuses across the internet, and any platform that allows users to specify some mechanism for doing any kind of computation can be abused to mine cryptocurrency. There are stories about people finding ways to get online spreadsheets, online code-compilation engines, and other forms of publicly available (or account-based freemium) computational infrastructure to mine crypto.

The Takeaway

Giving anything of value away on the internet is likely to attract the directed, persistent, focus of folks who wish to exploit the free offering. Computational power, storage capacity, and network bandwidth are all semi-fungible resources that must be thought of in in this light.

The commonality between these forms of abuse is that the abusers are essentially creating small cloud service providers, and having the company that offers the free service foot the bill. Identifying reasonable Limits, Account Creation Protections, and other interventions can go far to protect a platform from falling victim to this flavor of abuse.