Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

behind-the-enemy-lines.com

Post reply on HN
Print view View original

141–150 of 152 posts

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#141

Post by gizzlon »

ryantownsend wrote: post #140
gizzlon wrote: post #129

Earlier quoted context omitted.

Is that a term? "Cost of service attack" ? If not, let's coin it :) Cost-of-service-attack: Consuming bandwidth or other resources in cloud based solutions to drive up the cost of running the service. Very easy when the cost is so tightly coupled with the resource use...

I believe this kind of attack is already referred to as EDoS (Economic Denial of Service/Sustainability) - basically killing of a service through bankruptcy. This is why most cloud services have a customisable limit on how many virtual servers can be booted automatically, a solution is yet to be found for protecting S3.

Thanks..

"[snip]..one might envision that instead of worrying about a lack of resources, the elasticity of the cloud could actually provide a surplus of compute, network and storage utility that could be just as bad as a deficit"

http://rationalsecurity.typepad.com/blog/2009/01/a-couple-of...

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#142

Post by tripzilch »

EvilTerran wrote: post #37
sohn wrote: post #34

Earlier quoted context omitted.

They wouldn't be jerks if they asked for the charges; you still generated the traffic and they had to pay for it.

Just as "legal" does not mean "ethical", "contractually permitted" does not mean "not a jerk move".

Nor does failing "to be really nice" equal "jerk move".

Offering the refund was really nice. Asking to pay for the services would not have been a jerk move, because Amazon wasn't responsible for the extra costs either. I usually root for the little guy, but in this case, if anyone else might be expected to foot the bill, it should be Google for building a system that needlessly slurps 250GB/h without any apparent capping or rate-limiting, caused by a single spreadsheet. Just because Amazon S3 is huge and probably doesn't feel a thing doesn't mean it's a good idea, what if it were 500 spreadsheets doing this?

What if that FeederBot were to gorge itself onto one Google's own CDNs? Sure it's probably just a drop in the ocean for Google as well, but I bet they'd rather not experience this "minor inefficiency".

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#143

Post by tripzilch »

hm8 wrote: post #69
OzzyB wrote: post #52

+1 For Amazon for kindly reimbursing the overage charge. -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs. Seriously, is this what we have to look forward to when Google Spreadsheets, and God knows what else, become ever-more popular? Think about all the additional onerus costs that would be incurred by content providers as mor…

Like the author notes, I don't think the problem was with Google. It was no fault of theirs. The reason: It's a fine line between maintaining privacy policies and managing such events. If google were storing/caching these links, there would have been an outcry from those worried about user privacy and stuff. About the by-the-hour downloads, well there again is a trade-off between providing data quickly and doing a la…

> If google were storing/caching these links, there would have been an outcry from those worried about user privacy and stuff.

Where would we be without Google taking such a noble and strongly principled stance on user privacy, applied equally and consistently, striving to avoid legal responsibility, even when it costs unrelated parties thousands of dollars.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#144

Post by tripzilch »

eli wrote: post #29
justincormack wrote: post #12

Earlier quoted context omitted.

You can put a robots.txt in the bucket.

According to the article, that would not have helped; feedfetcher is meant to be manually triggered and thus does not obey robots.txt

For certain definitions of "manually" :)

It's manually triggered to start downloading resources every hour regardless of whether someone needs them.

In that sense, any web spider is "manually triggered" as well ;-)

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#146

Post by whackberry »

OzzyB wrote: post #52

+1 For Amazon for kindly reimbursing the overage charge. -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs. Seriously, is this what we have to look forward to when Google Spreadsheets, and God knows what else, become ever-more popular? Think about all the additional onerus costs that would be incurred by content providers as mor…

> -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs.

Wanna help make the web better? Stop using Google and use a competitor like DuckDuckGo.com. Google has too much power, too much control.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#147

Post by seanlinmt »

dredmorbius wrote: post #55
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

It's not that simple. First, the problem isn't inherent to virtual hosting services, you could just as easily get hit by this on a bare-metal site, though the interplay of S3 and Google Docs is an added dimension. Cutting off all services opens the door for a class of DoS attacks. Simply direct enough traffic at a single account's assets, and you'll knock them offline for a given billing cycle. If the attack is cheap…

Or if you have the connections, contact one of the Vetted and get the attackers at the origin. Well that's according to http://www.wired.com/politics/security/magazine/15-09/ff_est...

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#148

Post by RandallBrown »

BryanB55 wrote: post #117
RandallBrown wrote: post #51

If I wanted to launch an attack on something like Instagram all I would need to do is put a bunch of images (hosted on instagram) into a Google Spreadsheet? Then the google crawler will come through and download them all once an hour?

That's what I'm wondering too, I don't see how this would work on a normal website since a normal website probably wouldn't be whitelisted by Google like AWS is... What am I missing here?

I don't think you'd be able to take down a website with this strategy. The OPs site never went down, it just cost him a lot of money. Even pretty small webservers should be able to serve up static image files pretty easily.

But you could do a denial of service by making the service too expensive and all of your work would be hidden behind the anonymity of the google bot.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#149

Post by Freaky »

Panos wrote: post #115
Freaky wrote: post #106

Amusing thing about that page - it's full of '\$100', and uses Javascript to strip the \'s out, replacing them with empty elements. Not sure I really want to know why...

Mathjax :-)

Ah, that's a good excuse. Thanks :)

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#150

Post by mryan »

mryan wrote: post #72
raverbashing wrote: post #48

Earlier quoted context omitted.

A cutoff is good, but a triggered alarm would go a long way. For example in Linode you can configure trigger conditions for CPU (triggers in x% cpu for y time) and Network usage (there are other conditions as well) Very useful for flagging suspicious activity (or just plain accidents)

You can set this up with CloudWatch - add your EC2 costs as a metric, then you can create alarms based on your desired threshold (although I'm not sure how frequently this data is updated).

I have just discovered www.cloudability.com - they generate reports to give you insights in to your AWS bill, and you can configure budget notifications. I am trying the beta now and am very impressed so far.
Post reply on HN