4 ms·
Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an exis
by rdl 11y ago
Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs.
If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.
- ryanlol 11y ago>Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: http://i.imgur.com/0quYBdV.png http://i.imgur.com/0quYBdV.png a graph of an attack on reddit, from 2013). Today we're talking about Mrps, not Krps. >If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers. That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.