Ideally, if the webserver should just return HTTP 420 (Enhance your calm), 429 (Too many requests), or 509 (Bandwidth Limit exceeded).
Using Facebook Notes to DDoS any website
11–20 of 79 posts
Re: Using Facebook Notes to DDoS any website
#12> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Nonsense. Every web crawler should have some form of rate limiting. That's just good etiquette. I can control the number of requests that the Google search indexer sends to my site via webmaster tools. I don't see a good re…
Especially, Facebook is not supposed to intelligently crawl websites but to just proxy images. That's an easy one.
Yes, it should intelligently proxy images.
Re: Using Facebook Notes to DDoS any website
#13I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied. If enough people start using technique they will have no choice but to create a fix for this.
They were probably aware of the issue, as this kind of bug has been already published for Google [1] (by the same author, it seems) a month ago. Also, Google did not give him a bounty reward for his discovery. [1] https://news.ycombinator.com/item?id=7371176
I actually found this bug first in Facebook and later in Google. Facebook said they needed time to think about this and I was hoping they would fix it, so I could not disclose this back then.
Re: Using Facebook Notes to DDoS any website
#14I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied. If enough people start using technique they will have no choice but to create a fix for this.
https://www.facebook.com/whitehat Exclusions The following bugs are not eligible for a bounty (and we do not recommend testing for these): ... Denial of Service Vulnerabilities ... That said, they do appear to be quite hypocritical when it comes to enforcing this, as at least one user on the /r/netsec thread claimed that Facebook paid them for a mail bombing vulnerability. I guess you have to use this to attack high-…
It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd be different I guess.
Re: Using Facebook Notes to DDoS any website
#15> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Why not just limit the number of request per site and per user? Ie. John Smith can only make X request (let say 1000) to www.google.com. Doesn't seem too hard.
They state that 400-800 mbit/s == consumer grade sites? really?
When you're as totally awesome and uncaring about your customers as Facebook, you can toss out words like "consumer grade" to describe people affected by your fuck-ups.
Re: Using Facebook Notes to DDoS any website
#16I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied. If enough people start using technique they will have no choice but to create a fix for this.
It doesn't really hurt Facebook.
Re: Using Facebook Notes to DDoS any website
#17Earlier quoted context omitted.
https://www.facebook.com/whitehat Exclusions The following bugs are not eligible for a bounty (and we do not recommend testing for these): ... Denial of Service Vulnerabilities ... That said, they do appear to be quite hypocritical when it comes to enforcing this, as at least one user on the /r/netsec thread claimed that Facebook paid them for a mail bombing vulnerability. I guess you have to use this to attack high-…
It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd be different I guess.
I agree with you, forcing Facebook to be your zombie of doom is very different to attempting to DoS facebook.
If you can easily cause any website to become an on demand low orbit ion cannon, they're going to cause problems.
Re: Using Facebook Notes to DDoS any website
#18> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Why not just limit the number of request per site and per user? Ie. John Smith can only make X request (let say 1000) to www.google.com. Doesn't seem too hard.
They state that 400-800 mbit/s == consumer grade sites? really?
Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.
Re: Using Facebook Notes to DDoS any website
#19He's using "outbound" traffic as a DoS metric which is sort of novel. I guess it looked better than "1000 HTTP requests"?
Re: Using Facebook Notes to DDoS any website
#20Ideally, if the webserver should just return HTTP 420 (Enhance your calm), 429 (Too many requests), or 509 (Bandwidth Limit exceeded).
Side note: 420 is not a standard HTTP error.