Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

behind-the-enemy-lines.com

Post reply on HN
Print view View original

31–40 of 152 posts

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#31

Post by Yarnage »

bibinou wrote: post #28
Yarnage wrote: post #5

I'm pretty surprised Google didn't have the client download the images instead. Wouldn't that be a better solution or am I missing something here? Pretty interesting though and if this becomes a big enough story you can bet Google will be changing something; the last thing they need is someone using Google Docs to DOS websites.

Google Docs is in HTTPS so they need to proxy the assets like Github does : https://github.com/blog/743-sidejack-prevention-phase-3-ssl-...

Interesting. I never thought of that. It seems almost silly that you're bringing insecure content over a secure channel like that but then again it is only images.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#32

Post by JeremyBanks »

ceejayoz wrote: post #18
justincormack wrote: post #12

Earlier quoted context omitted.

You can put a robots.txt in the bucket.

No, you can't. It'd have to be at the root of http://s3.amazonaws.com/ . This is mentioned specifically in the article, in fact.

Pick subdomain-safe bucket names and you have an alternative.

    http://[bucket name].s3.amazonaws.com/robots.txt

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#33

Post by bri3d »

typpo wrote: post #14
ltcoleman wrote: post #2

This was an extremely interesting article. I hope Google rectifies this type of behavior. This is actually pretty scary.

This isn't Google's fault. I could get a couple machines and do the same thing if I had a list of 250 gigs of files. And I wouldn't be limited to once every hour.

But those machines wouldn't be Google's, and you would probably either be committing a crime (building an exploited botnet) or using someone's money (be it your employer, university, or yourself) to run them.

This is pretty clearly a different league of attack: rather than attacking systems or spending money, you'd be exploiting a Google feature to use Google's resource for free to incur a giant amount of data transfer.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#34

Post by sohn »

richardlblair wrote: post #24

It's really awesome that Amazon was reasonable and refunded the charges because they were accidental. I mean, technically it was still your fault, so it would have been easy for them to be jerks about it.

They wouldn't be jerks if they asked for the charges; you still generated the traffic and they had to pay for it.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#35

Post by simonw »

Panos wrote: post #16
justincormack wrote: post #12

Earlier quoted context omitted.

You can put a robots.txt in the bucket.

Which will be ignored by Feedfetcher :-) Plus you cannot put a robots.txt at s3.amazonaws.com so if the url is accessed through the https://s3.amazonaws.com/... . url, the robots.txt will not work.

You could put robots.txt in the bucket if you address it using the http://mybucket.s3.amazonaws.com/ alternative URL scheme - a robots.txt in the root of the bucket would then be available at http://mybucket.s3.amazonaws.com/robots.txt

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#36

Post by [deleted] »

gojomo wrote: post #8

But, why re-downloading every hour? Does merely having the spreadsheet passively open in a browser trigger that, or was some other process re-loading the spreadsheet every hour? (If the former, I wouldn't be as forgiving of Google. I understand the desire not to cache possibly-private data, but proper URL design and conditional GETs should be able to prevent the entire download on an automatic hourly schedule. And ev…

[deleted]

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#37

Post by EvilTerran »

sohn wrote: post #34
richardlblair wrote: post #24

It's really awesome that Amazon was reasonable and refunded the charges because they were accidental. I mean, technically it was still your fault, so it would have been easy for them to be jerks about it.

They wouldn't be jerks if they asked for the charges; you still generated the traffic and they had to pay for it.

Just as "legal" does not mean "ethical", "contractually permitted" does not mean "not a jerk move".

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#38

Post by EvilTerran »

Yarnage wrote: post #31
bibinou wrote: post #28

Earlier quoted context omitted.

Google Docs is in HTTPS so they need to proxy the assets like Github does : https://github.com/blog/743-sidejack-prevention-phase-3-ssl-...

Interesting. I never thought of that. It seems almost silly that you're bringing insecure content over a secure channel like that but then again it is only images.

"only images"

As long as they don't do WMFs, with their code-injection-by-design functionality...

http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#39

Post by adgar »

eli wrote: post #26
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

I guess that would be a nice feature to offer as an option, but most people would not want their web service cut off if they get a spike in traffic.

> most people would not want their web service cut off if they get a spike in traffic.

Only if they are sure enough about their finances and their web service to be confident that the spike will be profitable.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#40

Post by Panos »

simonw wrote: post #35
Panos wrote: post #16

Earlier quoted context omitted.

Which will be ignored by Feedfetcher :-) Plus you cannot put a robots.txt at s3.amazonaws.com so if the url is accessed through the https://s3.amazonaws.com/... . url, the robots.txt will not work.

You could put robots.txt in the bucket if you address it using the http://mybucket.s3.amazonaws.com/ alternative URL scheme - a robots.txt in the root of the bucket would then be available at http://mybucket.s3.amazonaws.com/robots.txt

Yes, that would solve the issue of not being able to have your own robots.txt file and I did not know about that. On the other hand, Feedfetcher would still ignore the robots.txt
Post reply on HN