A method to use Google for DDoS. Bug or Not? • Hacker News Board

Re: A method to use Google for DDoS. Bug or Not?

#11

Post by dantiberian » Mon, Mar 10, 2014, 4:27 AM UTC

Nice catch. I'm not so sure about:

  A simple fix will be just crawling the links without the request parameters so that we don’t have to suffer.

Many links would fail/have different content if the request parameters were removed from the URL. Perhaps the crawler could use some kind of reverse bloom filter [1] to be more careful/back off if it receives the same content from multiple URLs. However nothing is simple at Google scale so there are probably issues with this approach too.

[1]: http://www.somethingsimilar.com/2012/05/21/the-opposite-of-a...

Re: A method to use Google for DDoS. Bug or Not?

#12

Post by blauwbilgorgel » Mon, Mar 10, 2014, 4:27 AM UTC

This is about two years old: http://www.behind-the-enemy-lines.com/2012/04/google-attack-...

I would hope that Google is able to detect abuse of their infrastructure for (D)DOS.

Re: A method to use Google for DDoS. Bug or Not?

#13

Post by mickle00 » Mon, Mar 10, 2014, 4:29 AM UTC

Doesn't Facebook do something similar for preview links in chat and/or wall posts? You're probably limited by the number of messages/posts, but I wonder if that could be exploited with n number of fb accounts.

Re: A method to use Google for DDoS. Bug or Not?

#14

Post by userbinator » Mon, Mar 10, 2014, 4:29 AM UTC

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a DDoS.

Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

Re: A method to use Google for DDoS. Bug or Not?

#15

Post by chr13 » Mon, Mar 10, 2014, 4:30 AM UTC

blauwbilgorgel wrote: post #12

This is about two years old: http://www.behind-the-enemy-lines.com/2012/04/google-attack-... I would hope that Google is able to detect abuse of their infrastructure for (D)DOS.

Indeed, I've quoted that article. But it doesn't talk about random parameters which makes it so easy to attack any website not just your own where you know what the urls are.

Re: A method to use Google for DDoS. Bug or Not?

#16

Post by chr13 » Mon, Mar 10, 2014, 4:32 AM UTC

smelendez wrote: post #9

Nice catch! I don't think removing the parameters would be ideal, though, since some sites might legitimately serve up different images based on different parameters. Just limiting the amount of traffic to a single server, or outbound from a single spreadsheet, seems like a good solution, though.

Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another question.

Re: A method to use Google for DDoS. Bug or Not?

#17

Post by jhgg » Mon, Mar 10, 2014, 4:33 AM UTC

I've seen this bug floated around a few times, with the request parameters and all. Interestingly enough, you do not have to use an image either, and can link to any document on the server. In addition, it will work with nondeterministic values. So you can do (for example):

    =image(CONCATINATE("http://example.com/?", RAND()))

If you add this to a spreadsheet and fill a few thousand rows with it. Each time the spreadsheet is loaded, google will hit the server a few thousand times.

Re: A method to use Google for DDoS. Bug or Not?

#18

Post by knome » Mon, Mar 10, 2014, 4:33 AM UTC

userbinator wrote: post #14

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a D DoS. Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

Re: A method to use Google for DDoS. Bug or Not?

#19

Post by mschuster91 » Mon, Mar 10, 2014, 4:41 AM UTC

chr13 wrote: post #16

smelendez wrote: post #9

Nice catch! I don't think removing the parameters would be ideal, though, since some sites might legitimately serve up different images based on different parameters. Just limiting the amount of traffic to a single server, or outbound from a single spreadsheet, seems like a good solution, though.

Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another question.

I've seen people use Excel with millimetre-scaled columns for creating bills and other documents instead of using Word, no joke.

You see a surprisingly high amount of excel-based bill templates - and you may want to hotlink the company logo or a signature.

Re: A method to use Google for DDoS. Bug or Not?

#20

Post by mschuster91 » Mon, Mar 10, 2014, 4:41 AM UTC

knome wrote: post #18

userbinator wrote: post #14

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a D DoS. Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

But they could hash the filename (a hash prevents accidental disclosure of content).