Comment by DonPellegrino | Hacker News Reader

Comment by DonPellegrino | Hacker News Reader

Parent Full thread

This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites.

There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income.

Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.

>but I was shocked at the ease of carrying that kind of attack

From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud.

They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML.

What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.

You really should - that sounds super interesting!

How can your server blacklist requests to doubleclick.net?

I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.

Reply on news.ycombinator.com