DDOB (Distributed Denial of Budget Attack) to Cloud IDEA

sounds very very weak.

it can be detected by the patern you describe.

the attacker can be blocked in many ways from ever reaching the service.

and the attacker will be at least partly tracable such that the data center can block them.

and i would bet that microsoft and other will take court action on such attacks if they happen.

one simple example is to use a client id certificate plus ssl.

attacker never gets to the service w/o a cert.  every cert is issued to a known customer and revoked when / if abused or compromised.

with all the data using ssl + cert hacker has almost no chance to see any trafic or to know what it valid.

a hardware firewall could block traffic that does not have the cert before granting access to the web servers or other network elements.

firewall can log attempted inbound traffic and use this to block or to alert staff to trace hackers and finhd them.

no different really than any other network attack.

if you do not belive me than go try it....

it's an attack and can be proven by the very standards you have set forth.

my first basis is that to use my service you have to be my customer, if you do not have the right credentails then you will not have acess and each attempt is proof of an attempted attack on my service.

and if you some how fake my customer identity when i see junk requests i just stuf off that account and contact that customer.

and you have to start over...  repeat that a few times and i have a load of info i can report.

the more time you spend finding a way in the more it costs you in time and cpu power and network access costs to keep trying.

so that also works against you.

this becomes like the old mad magazine  "spy vs. spy"  in a way....

Scott and Stacey:  the OP wrote that the attack he was thinking of was to send fake requests to the service.

my point all thru his posts was very simple:  I would never allow random calls to my service from callers i did not know.

yes if someone signs up for a service and then abuses it there is a problem.  but that is true for any kind of service over the network and always has been. the OP seems to think that his idea is somehow new and different. my view is that it's not very different at all.

if you offer web hosting and some silly client runs huge bandwith thru your server you have to deal with it.

you have to have limits and safeguards. 

the OP also seems to think that the hosting provider will not be interested in stopping the attacks as they get paid when you get this kind of attack. my view is that a hosting provider or service provider that handles business that way will lose customers very fast.

it's not a thing they would really want to shine on / ignore.

yes there is reason to think about what to setup and how to manage it.

but I think we can also build in good safegaurds to limit such junk form hurting the businesses the way the OP seems to think is so easy.

Thanks,

and I would say that yes, much of this *MUST* be in the system for it to be worth developing with / for.

and i would expect the provider to be willing to see a log and agree to take it off the bill if i was not at-fault and treat it like any other case of netowork abuse / hacking etc... and be willing to work with me in taking the issue to the proper authorities if the case merits that.

any provider that did not treat it that way would not be getting my business for very long.

*IF* most developers and businesses do that then the providers will work that way or go out of business. that will prove the concept as valid or not in short order.