Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subscription bombing and how to mitigate it

bytemash.net

Post reply on HN
Print view View original

91–100 of 199 posts

Re: Subscription bombing and how to mitigate it

#91

Post by AndroTux »

pqdbr wrote: post #27

Recently we suffered a different kind of subscription bombing: a hacker using our 'change credit card' form to 'clean' a list of thousands credit cards to see which ones would go through and approve transactions. He ran the attack from midnight to 7AM, so there were no humans watching. IPs were rotated on every single request, so no rate limiter caught it. We had Cloudflare Turnstile installed in both the sign up for…

We solved this by introducing a silent block. If the system notices unusual behavior (too many payment attempts per user, for example), it no longer sends the payment attempt to the provider. Instead, it idles for a second or two and then just fails with a generic “payment declined.” Most attackers don’t notice they’re being blocked and just assume all credit cards are bad.

Re: Subscription bombing and how to mitigate it

#92

Post by avian »

znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

> We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup.

I hope "LLM thinks your name is gibberish" won't become the new "your name can't include invalid characters".

Re: Subscription bombing and how to mitigate it

#93

Post by tpoacher »

nubg wrote: post #34
denismi wrote: post #28

Earlier quoted context omitted.

I am quite confident that the following was NOT LLM: > New users were signing up but not doing anything, they weren’t creating an org, a project, or a deployment, they just left an account sitting there. Surely the LLM version is: > New users were signing up but not doing anything; they weren't creating an org, a project, or a deployment—they just left an account sitting there.

It really depends on the LLM and the wrapper prompt. There are many other giveaways though - which I am not going to name to burn them.

You really should stop using LLMs to write messages complaining about LLM use though. (the "it depends" and the hyphen-as-emdash were dead giveaways).

/s

Re: Subscription bombing and how to mitigate it

#94

Post by noname120 »

Gigachad wrote: post #56
chw9e wrote: post #48

This happened to me several years ago. I got signed up to probably 700 newsletters overnight. In the middle of all of the sign ups there was activity on my airbnb account where my notification settings were changed. when i checked my airbnb i noticed that someone had created a fake listing under my account and disabled booking notifications for it. a real multi-layer scam where the hacker would be making money off a…

I’d be probably safe against this because I have an email filter set so anything with an unsubscribe link gets moved to spam. Account notification emails don’t have unsubscribes while pretty much all junk does.

I receive a bunch of transactional emails with an unsubscribe button at the bottom. Unsubscribing of course does nothing to stop the transactional emails but the last thing I want is them to go to spams.

Re: Subscription bombing and how to mitigate it

#96

Post by stanac »

latexr wrote: post #76
znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

I added custom captcha (simple math as slightly distorted pictures with audio alternative) on one of my forms, it prevents ~80% of spam submissions. less than 1% of spam passes, other ~20% are blocked on key words (like "sex", "passion", etc...).

Re: Subscription bombing and how to mitigate it

#97

Post by AndroTux »

m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

I had a similar issue and evaluated alternatives. Sadly, there were none that did the job well enough.

How do you suggest to implement bot prevention that works reliably? Because at this point in time, LLMs are better at solving CAPTCHAs than humans are.

Re: Subscription bombing and how to mitigate it

#98

Post by znnajdla »

latexr wrote: post #76
znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

> useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by (…). Of course this is easy to get around if the bot knows what you’re doing So, by your own admission, your solution doesn’t get around the “sufficiently advanced bot” problem.

Yes and I don’t claim to solve the problem completely. It’s an impossible to solve problem which BigTech wants you to pay mafia protection money to “solve”.

Re: Subscription bombing and how to mitigate it

#99

Post by znnajdla »

tholm wrote: post #29
znnajdla wrote: post #22

I absolutely refuse to use BigTech gatekeepers or useless CAPTCHAS (any sufficiently advanced bot can get around any CAPTCHA anyway). We solved this at our startup by running names through a simple LLM filter - if the name is gibberish like Px2846skxojw just block the signup. Worked surprisingly well. Of course this is easy to get around if the bot knows what you’re doing. But bots look for easy targets, as long as t…

Using an LLM for this seems excessive when there are well established algorithms for detecting high entropy strings.

The high entropy string option led to lots of false positives. The LLM check seems to work fine with no complaints from real users.

Re: Subscription bombing and how to mitigate it

#100

Post by AndroTux »

AussieWog93 wrote: post #11
m132 wrote: post #5

It's a problem, but I really dislike the solution. Putting a website with known security issues behind Cloudflare's Turnstile is comparable to enforcing code signing—works until it doesn't, and in the meantime, helps centralize power around a single legal entitiy while pissing legitimate users off. The Internet was carefully designed to withstand a nuclear war and this approach, being adopted en masse, is slowly turn…

Honestly I really like CloudFlare as a business. There's no vendor lock-in, just a genuine good product. If they turn around later and do something evil, literally all I need to do is change the nameserver to a competitor and the users of my website won't even notice.

Then you're not using any of their services besides DNS, at which point you don't need to use Cloudflare at all.

As soon as you turn on any other service they offer, you need to actively migrate away. It's an inherent issue of services that actually provide a benefit. If you're saying "I can just migrate to any other nameserver" then you're telling me you have no use for Cloudflare in the first place. Because if you did, you couldn't just not use it anymore.

Let's say you're using their WAF. Sure, you can just change your domain's nameserver and you've migrated away. But now you no longer have a WAF. Same for their CDN. Or their load balancer. Or their object storage. Or their CAPTCHAs.

Post reply on HN