Hacker News Reader

Comment by m4jor | Hacker News Reader

also FYI a lot of places dont place limits on the size of their POST requests or timeouts.

I have been able to send scammers 500MB+ POST requests just by making the password field password=888888888888888888888888888888 (etc til its 100s of MB of data).

Use a tool like OWASP ZAP or Burp Suite and you can easily slam a scammers website full of 500mb+ requests that will quickly fill up their log files and cheap VPS harddrive and eventually the website will get an hdd full msg or just go offline til they fix it.

Cheap and easy way to take their website offline to prevent more people from getting scammed.

View on HN

I’m pretty sure this is a felony. I’m not against the spirit but want to warn others that you could get slapped.

If you use a password field can’t you reasonably argue that you want to actually have a really secure password? ;-)

I’m sick and tired of these 12b character limits on password complexity!

I'm sure it is, but a scammer or hacker committing a crime is most likely not going to report this. They would certainly get in trouble too.

To quote Nacho Varga: "I like ripping of thieves. They can't go to the cops. They have no recourse."

What exactly would the scammer/hacker say to the police/their lawyer? "Could you please help? I'm trying to scam innocent people out of their money, but some greyhat has filled up my server's logs with junk!"

Their ISP/host may report it.

How would the ISP know what data was sent over a https connection? The host may, but I doubt they care since the customer pays for the bandwidth.

Huge ingress traffic to a website which normally just serves stuff stands out from a pattern. Also, bad actors are often profitable customers of hosting companies and can ask/demand action without revealing themselves to a 3rd party.

It’s now a felony to send api calls? Give me a break

It's a crime to intentionally drive a car over someone. Legal systems vary across the world but I would imagine most of them account for mens rea.

So, crafting API calls to intentionally bring down a system most definitely can be a criminal offence.

Now if you're objection was to the use of felony as opposed to misdemeanor, then ignore whatever I said above.

The US unfortunately has intentionally vaguely written laws about misusing computer systems which can be interpreted to punish hackers and pentesters pretty harshly.

The CFAA is controversial because of how vague the statue is. It has no carveouts for vigilantes or "hack back", last I heard -- even though some in Congress were trying to push for "hack back" rights.

The DoJ is unlikely to prosecute a vigilante of scammers, but they have prosecuted others (eg. Aaron Swartz) who were doing a debatably morally upright actions while violating the letter of the law.

It’s a felony to mail people things? Not usually, but if you send them a pipe bomb it sure is.

This is an absurd analogy from where this began... I'm at most slowing down a server in Russia that is trying to defraud people, no one is getting hurt, and It's unlikely I'm costing them any money. Come back to reality.

Even better if they use AWS or other service, and end up with a huge unexpected bill at the end of the month

You'd have to find a reflection bug that makes them send everything back. Data into AWS is free https://aws.amazon.com/ec2/pricing/on-demand/#Data_Transfer "Data Transfer"

Eh, the malicious actor would typically be using a compromised or carded account.

Then the billing spike will be spotted by the victim of that compromise and likely report it, I'd expect..

Which is another angle to suggest in reports to incentive quick action, because they’re losing money keeping the service up.

I always log requests as "http://example.com/foo/bar/... [1234 bytes]".

If a site is designed for scamming, it will likely log the contents of the form submissions -- sensitive fields like username + password combos or other PII.

Reply on news.ycombinator.com