Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

behind-the-enemy-lines.com

Post reply on HN
Print view View original

61–70 of 152 posts

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#61

Post by mikeryan »

dredmorbius wrote: post #55
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

It's not that simple. First, the problem isn't inherent to virtual hosting services, you could just as easily get hit by this on a bare-metal site, though the interplay of S3 and Google Docs is an added dimension. Cutting off all services opens the door for a class of DoS attacks. Simply direct enough traffic at a single account's assets, and you'll knock them offline for a given billing cycle. If the attack is cheap…

Cutting off all services opens the door for a class of DoS attacks. Simply direct enough traffic at a single account's assets, and you'll knock them offline for a given billing cycle.

I dont' see this as a real issue (the potential DOS is there, but not a real problem with having a bandwidth metric kill switch). I'd assume this would be a configurable setting and would have to be enabled by choice. In the author's case I'm sure he'd prefer to have is service cut off prior to running up a 1k bill. If one of my test instances started bleeding bandwidth I'd prefer for it to just get killed then to rack up an ungainly bill. If its your production service then don't configure a cutoff.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#62

Post by icebraining »

Karunamon wrote: post #57
jmj42 wrote: post #46

Earlier quoted context omitted.

just like asking you to pay for the services you used is not a jerk move. Amazon did a nice thing, but the services were used. Asking to user to pay for those services (even if it was a mistake), would not have been a "jerk move"

Bandwidth pricing is a funny thing, in that it's only metered because it's convenient to do so. You haven't consumed any kind of finite resource by moving 1GB or 1000GB. There isn't any "use". And it makes good business sense besides. They can let the guy off and eat the probably less than a hundred or so bandwidth this guy actually cost them due to their upstream providers, get a good writeup and look better as a re…

You've consumed energy.

But in any case, even if in theory nothing is used, are you sure that Amazon doesn't have to pay for it too? Because then it's irrelevant whether it was really used or not.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#63

Post by nknight »

dredmorbius wrote: post #55
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

It's not that simple. First, the problem isn't inherent to virtual hosting services, you could just as easily get hit by this on a bare-metal site, though the interplay of S3 and Google Docs is an added dimension. Cutting off all services opens the door for a class of DoS attacks. Simply direct enough traffic at a single account's assets, and you'll knock them offline for a given billing cycle. If the attack is cheap…

> you'll knock them offline for a given billing cycle

Er... Because caps can never be raised mid-cycle?

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#64

Post by icebraining »

justincormack wrote: post #56
Panos wrote: post #40

Earlier quoted context omitted.

Yes, that would solve the issue of not being able to have your own robots.txt file and I did not know about that. On the other hand, Feedfetcher would still ignore the robots.txt

Google's justification for ignoring this is very weak.

I disagree. Feedfetcher is no different than a browser: it fetches the URL the user inserted, nothing more (unlike a spider, which discovers URLs by itself).

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#65

Post by DanBC »

K2h wrote: post #15

I loved your reference to the huge Russion bomb Tsar Bomba. I for one had never heard of it, and it made a great metaphor. [1] http://en.wikipedia.org/wiki/Tsar_Bomba

Check out the Nuclear Effects Calculator; You can see what effect various historical bombs would have. (They include Tsar Bomba.)

(http://nuclearsecrecy.com/blog/2012/02/03/presenting-nukemap...)

(http://news.ycombinator.com/item?id=3624714)

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#66

Post by derefr »

simonw wrote: post #35
Panos wrote: post #16

Earlier quoted context omitted.

Which will be ignored by Feedfetcher :-) Plus you cannot put a robots.txt at s3.amazonaws.com so if the url is accessed through the https://s3.amazonaws.com/... . url, the robots.txt will not work.

You could put robots.txt in the bucket if you address it using the http://mybucket.s3.amazonaws.com/ alternative URL scheme - a robots.txt in the root of the bucket would then be available at http://mybucket.s3.amazonaws.com/robots.txt

I believe the parent's point was that, for the HTTPS scheme, you can't use any alternative CNAMEs, because they won't match the key S3 serves--so if your site is designed to be HTTPS-by-default, and is attached to an S3 bucket, putting a robots.txt in it is moot.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#67

Post by [deleted] »

justincormack wrote: post #12
RobertKohr wrote: post #9

Can you limit bandwidth with AWS? Also, why would the spreadsheet be calling these images every hour. Did you have the spreadsheet open? Does google do this call even when no one is viewing the spreadsheet?

You can put a robots.txt in the bucket.

[deleted]

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#68

Post by guelo »

raverbashing wrote: post #48
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

A cutoff is good, but a triggered alarm would go a long way. For example in Linode you can configure trigger conditions for CPU (triggers in x% cpu for y time) and Network usage (there are other conditions as well) Very useful for flagging suspicious activity (or just plain accidents)

Amazon did send him a warning email.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#69

Post by hm8 »

OzzyB wrote: post #52

+1 For Amazon for kindly reimbursing the overage charge. -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs. Seriously, is this what we have to look forward to when Google Spreadsheets, and God knows what else, become ever-more popular? Think about all the additional onerus costs that would be incurred by content providers as mor…

Like the author notes, I don't think the problem was with Google. It was no fault of theirs. The reason: It's a fine line between maintaining privacy policies and managing such events. If google were storing/caching these links, there would have been an outcry from those worried about user privacy and stuff.

About the by-the-hour downloads, well there again is a trade-off between providing data quickly and doing a lazy evaluation.

I think, as the author notes, it was just an unfortunate event that was a consequence of good design decisions gone bad circumstantially and wreaking havoc for the author.

It was certainly nice of Amazon to have made that refund. The resources (read bandwidth) were used after all.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#70

Post by Karunamon »

icebraining wrote: post #62
Karunamon wrote: post #57

Earlier quoted context omitted.

Bandwidth pricing is a funny thing, in that it's only metered because it's convenient to do so. You haven't consumed any kind of finite resource by moving 1GB or 1000GB. There isn't any "use". And it makes good business sense besides. They can let the guy off and eat the probably less than a hundred or so bandwidth this guy actually cost them due to their upstream providers, get a good writeup and look better as a re…

You've consumed energy. But in any case, even if in theory nothing is used, are you sure that Amazon doesn't have to pay for it too? Because then it's irrelevant whether it was really used or not.

Not $1,000 worth in either case.
Post reply on HN