Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Facebook Notes to DDoS any website

chr13.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Using Facebook Notes to DDoS any website

#61

Post by chr13 »

MichaelGG wrote: post #39
iancarroll wrote: post #33

Earlier quoted context omitted.

I don't know what your setup is like but a connection != the requests my webserver can handle.

I know, it was two separate comments. A: It's "just" IO, performing probably the most heavily optimized IO pattern in the world (serving static files) and B: buying a 1Gbps uplink is trivial.

>"buying 1Gbps uplink is trivial"

1 Gbps dedicated uplink is not trivial everywhere in the world. You also need more quota. Facebook easily crawled more than 1 TB of data during an hour. The more the better may not be best solution here. The higher the uplink, faster Facebook may crawl. So instead of transfering 1 TB in an hour for a 1 Gbps uplink, the transfer will be 10 TB if you have 10 Gbps. This will also depend how much bandwidth they allow their crawler, there must be an upper limit though.

Re: Using Facebook Notes to DDoS any website

#62

Post by jrochkind1 »

NicoJuicy wrote: post #59

This can be fixed easily ( i have read it fast, but i suppose this could be a fix) Add a boolean to a attachment in the db, queryDiff Add a string (for md5 hash) Calculate the hash on every file with a query parameter, if the file is requested the second time (with different query parameters), check if the file hash is the same. If the file hash is the same, change the bool queryDiff Next time you fetch the file, que…

There's no way to know if difference in query parameter is a different image or not, you can't simply re-use a prior URL which is equivalent but for query param in place of a new one.

    http://example.org/images?image_id=12121
    http://example.org/images?image_id=7272

Re: Using Facebook Notes to DDoS any website

#63

Post by samolang »

pilsetnieks wrote: post #56
egeozcan wrote: post #55

Earlier quoted context omitted.

Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.

Or the Reddit alternative, "The Reddit Hug," which sounds quite heartwarming.

I've always seen it written as "the reddit hug of death". Not quite as heartwarming.

Re: Using Facebook Notes to DDoS any website

#64

Post by silentOpen »

mscarborough wrote: post #15
eyeareque wrote: post #6

Earlier quoted context omitted.

They state that 400-800 mbit/s == consumer grade sites? really?

When you're as totally awesome and uncaring about your customers as Facebook, you can toss out words like "consumer grade" to describe people affected by your fuck-ups.

Download fast and break (other people's) things.

Re: Using Facebook Notes to DDoS any website

#65

Post by TOMDM »

To the people saying that this won't really hurt facebook, I beg to differ, this is a relatively simple to deploy DDOS attack, if enough people start utilising it, I can see a fair amount of Facebooks resources being tied up in these attacks.

They will only fix it when it starts to hurt them it seems.

Re: Using Facebook Notes to DDoS any website

#66

Post by LukeB_UK »

panzi wrote: post #42

So giving a 404 for unknown get parameters should fix this for your own site? A way for Facebook to detect such a thing would be to hash the images and when two images have the same hash and only differ by some get parameter it could remember that it can ignore that parameter.

Not a reliable check. If the first 2 are the same, then this would cause a false positive as the third, fourth and fifth could all be completely different.

Re: Using Facebook Notes to DDoS any website

#67

Post by michaelt »

MichaelGG wrote: post #18
eyeareque wrote: post #6

Earlier quoted context omitted.

They state that 400-800 mbit/s == consumer grade sites? really?

Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.

Serving 1Gbps of traffic from Amazon S3 would cost $250,000 a year.

Maybe that's not a big deal to you, but it would be to me!

Re: Using Facebook Notes to DDoS any website

#69

Post by Nexxxeh »

lucb1e wrote: post #36

Thought Facebook had already fixed it. I tried with an image on my domain and it only went till about 660KB/s. Then I found a bigger file. It's now maxes out my upload speed (50mbps on fiber). The notes have been deleted but Facebook continues to do http requests for the file. That, or Apache continues to write requests to the access log after they finished and Facebook does not close active connections when it knows…

I wonder, what is the legality of having them DDoS themselves, using something they've suggested will not impact on someone of their scale, and that they won't fix?

Are you breaching their ToC or AUP? (I'm sure I've "agreed" to it but I doubt I've ever read it in full.)

Post reply on HN