Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Facebook Notes to DDoS any website

chr13.com

Post reply on HN
Print view View original

31–40 of 79 posts

Re: Using Facebook Notes to DDoS any website

#32

Post by MichaelGG »

chr13 wrote: post #21
MichaelGG wrote: post #19

He's using "outbound" traffic as a DoS metric which is sort of novel. I guess it looked better than "1000 HTTP requests"?

Actually the number of HTTP requests is 180,000+.

An an HTTP request requires what, 3 packets inbound? Just saying calling it a "DDoS" seems slightly generous.

Re: Using Facebook Notes to DDoS any website

#33

Post by iancarroll »

MichaelGG wrote: post #18
eyeareque wrote: post #6

Earlier quoted context omitted.

They state that 400-800 mbit/s == consumer grade sites? really?

Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.

I don't know what your setup is like but a connection != the requests my webserver can handle.

Re: Using Facebook Notes to DDoS any website

#35

Post by chr13 »

MichaelGG wrote: post #32
chr13 wrote: post #21

Earlier quoted context omitted.

Actually the number of HTTP requests is 180,000+.

An an HTTP request requires what, 3 packets inbound? Just saying calling it a "DDoS" seems slightly generous.

We also have to remember that these requests are shared between 100+ Facebook server.

Re: Using Facebook Notes to DDoS any website

#36

Post by lucb1e »

Thought Facebook had already fixed it. I tried with an image on my domain and it only went till about 660KB/s.

Then I found a bigger file.

It's now maxes out my upload speed (50mbps on fiber). The notes have been deleted but Facebook continues to do http requests for the file. That, or Apache continues to write requests to the access log after they finished and Facebook does not close active connections when it knows that the answer will never be used.

Edit: Found a video (big file) hosted by Facebook. Guess who's under attack now :D

Edit2: Seems they're loading at about 1.6-1.9gbps speed, calculating from how quickly the images seem to 'load' (become blank 1x1px images) on my client and how big the actual file is.

Re: Using Facebook Notes to DDoS any website

#37

Post by Terr_ »

Artemis2 wrote: post #8
leepowers wrote: post #7

> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Nonsense. Every web crawler should have some form of rate limiting. That's just good etiquette. I can control the number of requests that the Google search indexer sends to my site via webmaster tools. I don't see a good re…

Especially, Facebook is not supposed to intelligently crawl websites but to just proxy images. That's an easy one.

Ah, but intelligently for whom?

Benefits to Facebook might outweigh intangibles like "being nice" to the people and places they are indirectly making money off of.

Re: Using Facebook Notes to DDoS any website

#38

Post by brohee »

wisty wrote: post #16
eyeareque wrote: post #5

I'm surprised they aren't going to give him a bounty for this. I also assume they realize that most reporters will post their rejected findings soon after they get denied. If enough people start using technique they will have no choice but to create a fix for this.

It doesn't really hurt Facebook.

Well if enough people point the images to a tarpit it might...

Re: Using Facebook Notes to DDoS any website

#39

Post by MichaelGG »

iancarroll wrote: post #33
MichaelGG wrote: post #18

Earlier quoted context omitted.

Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.

I don't know what your setup is like but a connection != the requests my webserver can handle.

I know, it was two separate comments. A: It's "just" IO, performing probably the most heavily optimized IO pattern in the world (serving static files) and B: buying a 1Gbps uplink is trivial.
Post reply on HN