Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A method to use Google for DDoS. Bug or Not?

chr13.com

Post reply on HN
Print view View original

31–40 of 54 posts

Re: A method to use Google for DDoS. Bug or Not?

#31

Post by rogerbinns »

userbinator wrote: post #21
knome wrote: post #18

Earlier quoted context omitted.

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

http://en.wikipedia.org/wiki/HTTP_ETag (I know that servers can be configured not to send ETags or break caches by sending random ones every time, but this could reduce the data usage considerably since most of the responses would only include the headers.)

The query parameters make each request different. Etags are not unique across the internet - just for a specific url. There is no way an etag would help here, unless the same request is made later. Even making a request with an Etag still means lots of headers returned which while not 10MB will add up to lots of traffic.

Re: A method to use Google for DDoS. Bug or Not?

#32

Post by glass_of_water »

ma2rten wrote: post #30
knome wrote: post #18

Earlier quoted context omitted.

How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.

How could Google use hashes to avoid duplication? Rate limit per website (e.g. don't download more than 10 images per domain per second) Limit the total number of images it downloads per document, so a single user can not cause too much traffic.

In that case, users may notice a performance decrease in spreadsheets for images from certain websites.

Re: A method to use Google for DDoS. Bug or Not?

#34

Post by Houshalter »

mickle00 wrote: post #13

Doesn't Facebook do something similar for preview links in chat and/or wall posts? You're probably limited by the number of messages/posts, but I wonder if that could be exploited with n number of fb accounts.

There are reports skype does it to.

Re: A method to use Google for DDoS. Bug or Not?

#35

Post by nbody »

chr13 wrote: post #15
blauwbilgorgel wrote: post #12

This is about two years old: http://www.behind-the-enemy-lines.com/2012/04/google-attack-... I would hope that Google is able to detect abuse of their infrastructure for (D)DOS.

Indeed, I've quoted that article. But it doesn't talk about random parameters which makes it so easy to attack any website not just your own where you know what the urls are.

Nothing mind blowing, same vulnerability really, there are many ways to extend the core issue.

Re: A method to use Google for DDoS. Bug or Not?

#38

Post by est »

dantiberian wrote: post #11

Nice catch. I'm not so sure about: A simple fix will be just crawling the links without the request parameters so that we don’t have to suffer. Many links would fail/have different content if the request parameters were removed from the URL. Perhaps the crawler could use some kind of reverse bloom filter [1] to be more careful/back off if it receives the same content from multiple URLs. However nothing is simple at G…

You can always change that to

    =image("http://targetname/1.jpg")   
    =image("http://targetname/2.jpg")   
    =image("http://targetname/3.jpg")

Re: A method to use Google for DDoS. Bug or Not?

#39

Post by tempestn »

The other huge problem here is that Google's FeedFetcher doesn't respect robots.txt. (Their reasoning is that it is acting at the direct request of a human to retrieve a specific resource, so it doesn't count as a bot.) Because of this, there is no easy way to stop it from hitting your site.
Post reply on HN