"As more people start using cloud infrastructure, I absolutely think we will see malicious uses as well," says MacPherson. "I would encourage anyone using those infrastructures to not make security a chewing-gum, bolt-on-after-the-development sort of infrastructure."

In some ways, criminals have already started their own cloud services by compromising users' computers and centrally controlling them. These botnets, as such networks are called, can be used for different tasks, such as sending spam, hosting malicious content, or sending a flood of data to overwhelm a target network. Some underground entrepreneurs even created an online market, dubbed Golden Cash, where criminals could buy or lease any number of compromised computers.

If a cloud service provider does not monitor its network sufficiently, a criminal could use the service to do the same thing.

"When you are building a botnet, what you are trying to do is use a lot of computers for some purpose," Cross says. "If you can get a hold of a credit card, you can purchase a whole slew of virtual computers from a cloud provider."

Already, Amazon's service has become a playground for security researchers. This past summer, security firm SensePost revealed a number of techniques for abusing cloud services. By misusing the account creation process, for example, the researchers easily avoided Amazon's 20-computer limit per customer. SensePost's security team also demonstrated ways that malicious developers could create virtual-machine templates that included rootkits or other malicious code. If another Amazon customer used the template, they could find themselves vulnerable to attack.

"The cloud is going to offer the serious criminal huge computing resources on tap, which has lots of interesting applications," says Haroon Meer, director of security research for SensePost. "If nothing else, it should change a few threat models."