Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A method to use Google for DDoS. Bug or Not?

chr13.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: A method to use Google for DDoS. Bug or Not?

#41

Post by [deleted] »

rogerbinns wrote: post #31
userbinator wrote: post #21

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/HTTP_ETag (I know that servers can be configured not to send ETags or break caches by sending random ones every time, but this could reduce the data usage considerably since most of the responses would only include the headers.)

The query parameters make each request different. Etags are not unique across the internet - just for a specific url. There is no way an etag would help here, unless the same request is made later. Even making a request with an Etag still means lots of headers returned which while not 10MB will add up to lots of traffic.

[deleted]

Re: A method to use Google for DDoS. Bug or Not?

#42

Post by nieve »

jdappletini wrote: post #40

DaaS - DDOS as a service :)

DDOS as a Service has been around for years, the difference is that Google is trying to muscle in and undercut the competition with a free service. Unlike the extant players their customer service is nonexistent, so I'm sure the big DaaS companies won't lose too much business...

Re: A method to use Google for DDoS. Bug or Not?

#43

Post by robzyb »

est wrote: post #38
dantiberian wrote: post #11

Nice catch. I'm not so sure about: A simple fix will be just crawling the links without the request parameters so that we don’t have to suffer. Many links would fail/have different content if the request parameters were removed from the URL. Perhaps the crawler could use some kind of reverse bloom filter [1] to be more careful/back off if it receives the same content from multiple URLs. However nothing is simple at G…

You can always change that to =image("http://targetname/1.jpg") =image("http://targetname/2.jpg") =image("http://targetname/3.jpg")

But what if 2.jpg doesn't exist? Or is a trivially small file?

The advantage of the querystring-method is that you can just find one suitable (i.e. huge) file and force Google to pull it down many times.

Re: A method to use Google for DDoS. Bug or Not?

#44

Post by HNaTTY »

tempestn wrote: post #39

The other huge problem here is that Google's FeedFetcher doesn't respect robots.txt. (Their reasoning is that it is acting at the direct request of a human to retrieve a specific resource, so it doesn't count as a bot.) Because of this, there is no easy way to stop it from hitting your site.

You can block the user agent, I believe "Feedfetcher-google" should work.

Re: A method to use Google for DDoS. Bug or Not?

#45

Post by munimkazia »

Fetching the content without request parameters is not a fix, as the author claims. This depends entirely on the server and the way the content is stored, but request parameters can be used to determine what sort of content is fetched, and removing those parameters can form an invalid request.

Re: A method to use Google for DDoS. Bug or Not?

#46

Post by yeukhon »

chr13 wrote: post #16
smelendez wrote: post #9

Nice catch! I don't think removing the parameters would be ideal, though, since some sites might legitimately serve up different images based on different parameters. Just limiting the amount of traffic to a single server, or outbound from a single spreadsheet, seems like a good solution, though.

Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another question.

The reason I use Google docs is to use Google to fetch and do the rendering for me. I don't include images in my spreadsheet but I certainly think some people do. It's a feature.

Moreover, the issue is not about the feature, it's whether Google should limit the number of requests made per image. From other comments it seems like Google is hitting each image hundreds or even thousands of times. I suspect this is for cache? If that's the case, Google should look at better way to handle it. A single fetch and propagate to closest zone should be enough. But this is not a reason to limit the feature (eliminating parameter query).

Re: A method to use Google for DDoS. Bug or Not?

#49

Post by chr13 »

tedchs wrote: post #48

Many of the questions here are already answered officially by Google: https://support.google.com/webmasters/answer/178852

May be they should visibly put that FeedFetcher can crawl your website can incur 1TB bandwidth in couple of hours ? May be apache and other httpd should block these crawlers by default ? How else would anyone know about a certain Google feature that could be disaster for them ?

Re: A method to use Google for DDoS. Bug or Not?

#50

Post by chr13 »

Houshalter wrote: post #34
mickle00 wrote: post #13

Doesn't Facebook do something similar for preview links in chat and/or wall posts? You're probably limited by the number of messages/posts, but I wonder if that could be exploited with n number of fb accounts.

There are reports skype does it to.

Don't want to disclose anything at this point but at least one other huge bandwidth owner suffers from this type of attack. Combined, it is clearly a disaster for any small-medium business.
Post reply on HN