How I attacked myself using Google and I ramped up a $1000 bandwidth bill • Hacker News Board

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#71

Post by icebraining » Wed, Apr 25, 2012, 9:28 PM UTC

Karunamon wrote: post #70

icebraining wrote: post #62

Earlier quoted context omitted.

You've consumed energy. But in any case, even if in theory nothing is used, are you sure that Amazon doesn't have to pay for it too? Because then it's irrelevant whether it was really used or not.

Not $1,000 worth in either case.

Are you taking in account the time spent by the tech person(s) to read his email and process the rebates? People time is expensive, particularly if some manager needs to approve it.

Maybe it wouldn't be $1000, but it'd still be significantly more than $0.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#72

Post by mryan » Wed, Apr 25, 2012, 9:30 PM UTC

raverbashing wrote: post #48

tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

A cutoff is good, but a triggered alarm would go a long way. For example in Linode you can configure trigger conditions for CPU (triggers in x% cpu for y time) and Network usage (there are other conditions as well) Very useful for flagging suspicious activity (or just plain accidents)

You can set this up with CloudWatch - add your EC2 costs as a metric, then you can create alarms based on your desired threshold (although I'm not sure how frequently this data is updated).

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#73

Post by lubujackson » Wed, Apr 25, 2012, 9:32 PM UTC

Here's the big money question, since I haven't used S3 - do you have any throttling control? Can you simply block the feedfetcher bot, or block repeated hits like this at all? It seems like S3 is a nightmare $$$ hole if there aren't some really robust tools to manage this sort of problem.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#74

Post by drivebyacct2 » Wed, Apr 25, 2012, 9:39 PM UTC

>"But how come did Google download the images again and again?"

"But how come did" indeed.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#75

Post by sp332 » Wed, Apr 25, 2012, 9:42 PM UTC

OzzyB wrote: post #52

+1 For Amazon for kindly reimbursing the overage charge. -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs. Seriously, is this what we have to look forward to when Google Spreadsheets, and God knows what else, become ever-more popular? Think about all the additional onerus costs that would be incurred by content providers as mor…

It's not a DDOS becuase it's not distributed and there was no denial of service. And it doesn't work "across the entire interwebs" because the Google bots are rate-limited against most websites. There are some whitelisted sites, like S3, that are not rate-limited. S3 did not go down in this "attack". In fact the app didn't even go down. So the decision not to rate-limit against S3 was sound, since there was no DDOS.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#76

Post by lubujackson » Wed, Apr 25, 2012, 9:45 PM UTC

icebraining wrote: post #64

justincormack wrote: post #56

Earlier quoted context omitted.

Google's justification for ignoring this is very weak.

I disagree. Feedfetcher is no different than a browser: it fetches the URL the user inserted, nothing more (unlike a spider, which discovers URLs by itself).

Not true. It fetches the URL every single hour, not just when the user requests it. So Google is claiming they can ignore robots.txt because it was an action performed by a user (true) but they're unleashing a huge problem with this background refreshing. Google is wasting gobs of their own money, too. What if I made a bot that generated 1000s of Google accounts with 1000s of spreadsheets hotlinking 1000s of big files stored on S3? This one guy's one file did TERABYTES of transfers over a week. The underlying problem is that Google is relying on the domain name to indicate the company size, and thus the bandwidth allocation for this service.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#77

Post by tantalor » Wed, Apr 25, 2012, 9:45 PM UTC

pavel_lishin wrote: post #50

tybris wrote: post #27

Earlier quoted context omitted.

End of the article: "PS: Amazon was nice enough to refund the bandwidth charges, as they considered this activity accidental and not intentional. Thanks TK!"

Would they have refunded him if someone did this to him maliciously, as he points out is possible at the end of his post?

That might also qualify as an "accident".

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#78

Post by tantalor » Wed, Apr 25, 2012, 9:48 PM UTC

bri3d wrote: post #33

typpo wrote: post #14

Earlier quoted context omitted.

This isn't Google's fault. I could get a couple machines and do the same thing if I had a list of 250 gigs of files. And I wouldn't be limited to once every hour.

But those machines wouldn't be Google's, and you would probably either be committing a crime (building an exploited botnet) or using someone's money (be it your employer, university, or yourself) to run them. This is pretty clearly a different league of attack: rather than attacking systems or spending money, you'd be exploiting a Google feature to use Google's resource for free to incur a giant amount of data transf…

It would almost certainly be criminal regardless of the method (Google, EC2, botnet).

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#79

Post by vladd » Wed, Apr 25, 2012, 9:50 PM UTC

I cannot help notice that Hetzner offers 5000 GB/month AND a full dedicated server, for 39 EUR (51 USD) [1], so his traffic would have cost him at that rate a total of 100 USD if he were to use a dedicated server instead of Amazon.

(before mentioning Amazon's scalability, consider that Hacker News is ran on a single dedicated server, and the moral of the story seems to be how not to scale especially when you don't want to)

[1] - http://www.hetzner.de/en/hosting/produkte_rootserver/x3

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#80

Post by Karunamon » Wed, Apr 25, 2012, 9:53 PM UTC

icebraining wrote: post #71

Karunamon wrote: post #70

Earlier quoted context omitted.

Not $1,000 worth in either case.

Are you taking in account the time spent by the tech person(s) to read his email and process the rebates? People time is expensive, particularly if some manager needs to approve it. Maybe it wouldn't be $1000, but it'd still be significantly more than $0.

We're not counting rebates yet - we're saying "This guy ran X amount of bandwidth through our system which we normally charge Y for" - how much did Amazon pay their upstream for that bandwidth and the billing (which is all completely automated)