Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Facebook Notes to DDoS any website

chr13.com

Post reply on HN
Print view View original

21–30 of 79 posts

Re: Using Facebook Notes to DDoS any website

#22

Post by userbinator »

mattmanser wrote: post #17
chr13 wrote: post #14

Earlier quoted context omitted.

It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd be different I guess.

I agree with you, forcing Facebook to be your zombie of doom is very different to attempting to DoS facebook. If you can easily cause any website to become an on demand low orbit ion cannon, they're going to cause problems.

> If you can easily cause any website to become an on demand low orbit ion cannon

You can do this with any website that lets users post links which may or may not be automatically loaded (by other users too). There are tons of these around; forums, blogs, etc. See also: Slashdot effect. That's also a true DDoS, coming from many IPs, as compared with a few of Facebook's servers.

Re: Using Facebook Notes to DDoS any website

#23

Post by mey »

wisty wrote: post #16
eyeareque wrote: post #5

I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied. If enough people start using technique they will have no choice but to create a fix for this.

It doesn't really hurt Facebook.

Tying up these servers impacts them, makes people start blocking them, breaking this service.

Re: Using Facebook Notes to DDoS any website

#25

Post by RKoutnik »

This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target.

[1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook

Re: Using Facebook Notes to DDoS any website

#26

Post by STRiDEX »

RKoutnik wrote: post #25

This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook

Next post: using hacker news to DDoS any website.

Re: Using Facebook Notes to DDoS any website

#28

Post by patcheudor »

chr13 wrote: post #13
Artemis2 wrote: post #10

Earlier quoted context omitted.

They were probably aware of the issue, as this kind of bug has been already published for Google [1] (by the same author, it seems) a month ago. Also, Google did not give him a bounty reward for his discovery. [1] https://news.ycombinator.com/item?id=7371176

I actually found this bug first in Facebook and later in Google. Facebook said they needed time to think about this and I was hoping they would fix it, so I could not disclose this back then.

Join the club. I've reported it before as well, years ago. I even discussed it on my FB wall at one point with some tests against my own site. I never re-tested, figuring they'd take care of the issue. Guess not.
Post reply on HN