Hacker News Reader

Comment by cardine | Hacker News Reader

In my experience, the biggest issue I run into is targeted botnet brute force attacks.

In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination.

In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they alternate IPs with every request.

Automatically adding a blanket ReCAPTCHA on all login pages during a distributed brute force attempt is one of the few things that actually stops an attacker like this with minimal negative consequences.

I'm sure it is frustrating to users, but I think service disruption from what is effectively a DDoS is a worse user experience.

View on HN

It doesnt have to be botnets. Proxylists are enough to enable that attack for almost anyone. Pornsites have had that problem for decades and their solution was captchas, which led to OCR on the attacker site which resulted in stuff like recaptcha. Since you are attacked by one guy who makes a focused effort you are just causing him more effort for the initial setup with the other solutions mentioned not actually stopping him. It sucks but it still beats the alternatives.

I've never dealt with anything seriously distributed. Are they running full browsers or simple scripts? Do they execute JS, do they load images? Do they perform other actions on the site, or will they show up with their initial request be a login request? Do they simulate keyboard and mouse events?

Curious about this too

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least:

1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses,

2. Associate each IP address with a single user agent and suite of cookies,

3. Associate each IP address with a particular target username,

4. Only attempt a few incorrect logins at a time, and a somewhat random (albeit realistic) number at that, within a given time interval,

5. Use random, apparently human delays between successive requests,

6. Issue requests using extremely high fidelity simulacra of web browsers, customized to the sequence and structure of HTTP requests on the website.

When the stakes are high this is the kind of opposition you'll get. Bank account takeover, social media account takeover, ticket scalping, automated sneaker buying, financial research, market research, etc.

Recaptcha introduces unpleasant user friction, but it usually works well. To invert a popular turn of phrase, it makes stopping simple attackers easy and hard attackers possible. The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them.

Technical sophistication is only one dimension of this game. The other is making adversaries spend more money than they can gain from being successful.

> automated sneaker buying

???

Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Why don't they just sell more of them?

Or as ALittleLight says, auction them?

Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.

> Doesn't seem like the seller's responsibility.

sounds like to me that the seller doesn't want the scalper to sell outside the official channels imho. It might dilute the brand as well.

Exclusivity agreements are anti-competitive tbqh

The real problem is supply. Popular tickets are scalped because there's only so many tickets. Then unpopular tickets are scalped because it was so easy to scalp the popular ones.

There's only so many sneakers that can be made: making more chews up the supply chain for something which isn't _truly_ being consumed.

Why do "official channels" matter? They're just sneakers.

And why brand dilution? Scalpers sell at a premium, not discounted.

Seems like a market problem. Why not auction the sneakers?

To be clear, I don’t have a horse in this particular race. I’m neither condemning nor condoning the market dynamics of sneaker arbitrage here. It’s just an example I’m very familiar with because I used to write scrapers and I’ve been offered silly amounts of money to make them for sneaker trading groups. Not as much as hedge funds will pay for writing crawlers for market research, but still more than you’d probably expect just so they can flip Supreme shirts and Yeezys faster than competitors. It’s ridiculous, but this is the world we live in. The point is simply that when the stakes are high (particularly when there is money to be made), stopping adversaries will be really, really difficult.

Back to the point at hand, I don’t like recaptcha in principle. But given my view from both sides of the table, it’s one of very few things that consistently works for sophisticated adversaries. It’s about as close to a silver bullet as they come, with the additional upside that it’s the absolute easiest thing to implement - in both an absolute sense and relative to the return. And once you have, most of what you can implement beyond recaptcha has diminishing returns in comparison.

All of that being said, I would be inclined to agree that most websites and apps don’t need recaptcha, simply because most of them aren’t worthwhile targets for the types of attacks recaptcha is singularly effective against.

Hedge fund paying for scrapers, is that a common thing these days? What kind of prices do they pay if I may ask?

Extremely common. Most hedge funds buy what's called "alternative data" from vendors who aggregate it, like 7Park. The data is collected by providers who collect it from location telemetry, web scraping, satellite imagery, etc. Scraping from web applications is one of the more common forms.

The more successful quant funds will often build out internal research teams to do this. For example, both Two Sigma and Millennium have (not so well advertised) research teams devoted to this kind of data collection internally.

The rapper Post Malone released a custom collaboration with Crocs and the shoe sold out in 24 hours, reselling on eBay for several hundred dollars.

https://www.digitalmusicnews.com/2018/11/02/post-malone-croc...

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses

How are they getting residential IP addresses, compromised PCs?

Other commenters have basically answered already, but to be clear Luminati is not the only provider, just the most infamous. It’s very easy to find others of greater or lesser reliability. Search “residential IPs proxy” and you’ll find many vendors.

But yes, the whole cottage industry is sketchy. Almost all providers are leasing users’ computer with outright malware or shady TOS. The savvy play is to release a free game, app or even SDK which will then opportunistically route requests from the control server through the user’s device.

Recaptcha solving APIs are frequently bundled with the more reliable and premium services of this kind. They introduce a lot of latency since there’s a real mechanical turk across the world solving it for you, but they basically work.

https://luminati.io/#pricing

How the hell do they get people to open up their home computer to be used this way?

They encourage developers to include their SDK:

> Monetize your mobile app or game with our SDK, without showing intrusive ads or requiring annoying subscriptions and in app purchases.

https://luminati.io/sdk

They approached nmap of all people:

> Hi,

> My name is Lior and I'd like to offer you a new way to make money off your software. The Luminati SDK provides your users the option to use your software for free by contributing to the Luminati proxy network.

> We will pay you $3,000 USD a month for every 100K daily active users.

> No collection of users' data, no disruption of user experience.

> I'd like to schedule a 15 minute call to let you know how we can start. Are you available tomorrow at 12:30pm your local time?

> Best regards,

> Lior

https://seclists.org/nmap-dev/2018/q1/27

$3000 USD for 100k users? If you can get five pennies from each you're better off than with this crap.

The equation changes if you actually care about your users' experience. Or if you don't and include both Luminati and ads.

It's pretty hard to get five pennies from each of your users

Users of free mobile apps (mostly games) are offered the option of allowing use of their devices as proxies as an alternative to being interrupted by ads.

https://luminati.io/faq

Excellent, a new botnet to exploit. ;)

They pay developers to include the Luminati "SDK" (their euphemism for malware) in popular apps.

Sounds like the answer is to increase the response size for failed login requests. At $12.5/G, if you blow up your response to a mega byte, they'll spend about a cent per try - close to the rate they'll need to pay to have recaptchas solved by humans.

Most criminals are not using services like Luminati - they are using actual botnets made up of compromised computers. In that case, their bandwidth costs are far cheaper than yours.

Then can't they run-out-of-money DDoS you fairly easily? Since you'd pay for the outgoing bandwidth and at Google Cloud and AWS that's expensive.

I don't know how expensive it is with Google/AWS, but I'm paying about $1.50 per TB at my non-cloud-host (vs their $12500/TB), so if it comes down to it, they need to outspend me by multiple magnitudes. Sucks, but still cheaper than losing customers due to hyper-annoying Recaptchas, and I doubt that somebody is willing to stomach $12500 cost to make me suffer $1.50 ... I'm sure there would be more efficient attacks ;)

>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them.

You can also just pay people to solve recaptchas all day.

That's what mechanical turk is.

Thanks a lot for the correction. I blame the lack of coffee...

However that still contributes to security. If you make the expense of bypassing it greater then the worth of accessing the site then you have stopped them.

Sounds like big operations like that should have been putting people into jail

If only.

You need to update your intel to 2019 where botnets cost peanuts and I can trivially rotate a tiny botnet of 100k IP addresses against your "solution", each IP addresses making a couple attempts. Modern script kiddie software has had that built in for over a decade.

Never had your /login forum attacked with {uname,pass} combos? This is exactly what the traffic looks like.

Reply on news.ycombinator.com