Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A method to use Google for DDoS. Bug or Not?

chr13.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: A method to use Google for DDoS. Bug or Not?

#21

Post by userbinator »

knome wrote: post #18
userbinator wrote: post #14

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a D DoS. Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

http://en.wikipedia.org/wiki/HTTP_ETag

(I know that servers can be configured not to send ETags or break caches by sending random ones every time, but this could reduce the data usage considerably since most of the responses would only include the headers.)

Re: A method to use Google for DDoS. Bug or Not?

#22

Post by toast0 »

mschuster91 wrote: post #20
knome wrote: post #18

Earlier quoted context omitted.

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

But they could hash the filename (a hash prevents accidental disclosure of content).

Hashing the filename doesn't help, the URL is different, which is why caching doesn't work.

If we ignore that ETags are related to URLs and not 'files', ETag as suggested by userbinator might work for some cases, but if the large file is dynamically generated, it's unlikely to have an ETag; defaults in many servers are to make an ETag based on the inode of the file rather than any properties of the file, so if there are multiple servers behind a load balancer, they're likely to return different ETags.

Re: A method to use Google for DDoS. Bug or Not?

#23

Post by blauwbilgorgel »

knome wrote: post #18
userbinator wrote: post #14

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a D DoS. Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

The damage could be 3 downloads per Google Document. If 3 downloads produce 3 similar hashes then start limiter/throw up capchta/delay to avoid heavy intra-document duplication.

Re: A method to use Google for DDoS. Bug or Not?

#24

Post by toast0 »

> Since Google uses multiple IP addresses to crawl it’s also difficult to block these type of GET flood

It wouldn't be too hard to block by User-Agent: Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html); if you notice the traffic.

Feedfetcher does not fetch robots.txt though; so you'd have to do something in your server config.

[edit: fixed a typo, and agree with the update]

Re: A method to use Google for DDoS. Bug or Not?

#25

Post by chr13 »

toast0 wrote: post #24

> Since Google uses multiple IP addresses to crawl it’s also difficult to block these type of GET flood It wouldn't be too hard to block by User-Agent: Mozilla/5.0 (compatible) Feedfetcher-Google; (+ http://www.google.com/feedfetcher.html); if you notice the traffic. Feedfetcher does not fetch robots.txt though; so you'd have to do something in your server config. [edit: fixed a typo, and agree with the update]

Thanks, I've updated the post.

Re: A method to use Google for DDoS. Bug or Not?

#26

Post by AnonymousRetard »

I've decided to stress test this idea. This is what google errors on:

"It's taking a while to calculate formulas. More results may appear shortly."

I set the spreadsheet document to load images like so: =image("http://example.com/image?id=146&r={increment here}")

After 30 or so images, google starts to slow down its fetch rate.

Re: A method to use Google for DDoS. Bug or Not?

#27

Post by userbinator »

chr13 wrote: post #16
smelendez wrote: post #9

Nice catch! I don't think removing the parameters would be ideal, though, since some sites might legitimately serve up different images based on different parameters. Just limiting the amount of traffic to a single server, or outbound from a single spreadsheet, seems like a good solution, though.

Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another question.

> If a user needs a dynamic image he can download it to his own machine and upload it.

Doesn't that somewhat defeat the purpose of a dynamic image?

Re: A method to use Google for DDoS. Bug or Not?

#28

Post by chr13 »

AnonymousRetard wrote: post #26

I've decided to stress test this idea. This is what google errors on: "It's taking a while to calculate formulas. More results may appear shortly." I set the spreadsheet document to load images like so: =image(" http://example.com/image?id=146&r={increment here}") After 30 or so images, google starts to slow down its fetch rate.

Multiple spreadsheets ?

Re: A method to use Google for DDoS. Bug or Not?

#29

Post by AnonymousRetard »

chr13 wrote: post #28
AnonymousRetard wrote: post #26

I've decided to stress test this idea. This is what google errors on: "It's taking a while to calculate formulas. More results may appear shortly." I set the spreadsheet document to load images like so: =image(" http://example.com/image?id=146&r={increment here}") After 30 or so images, google starts to slow down its fetch rate.

Multiple spreadsheets ?

30 per spreadsheet it would seem. It seems to be that if the document takes longer then 2 seconds to load, it starts limiting itself.

Re: A method to use Google for DDoS. Bug or Not?

#30

Post by ma2rten »

knome wrote: post #18
userbinator wrote: post #14

I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a D DoS. Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

How could Google use hashes to avoid duplication?

Rate limit per website (e.g. don't download more than 10 images per domain per second)

Limit the total number of images it downloads per document, so a single user can not cause too much traffic.

Post reply on HN