7 ms·
As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries
by throwawaymath 7y ago
As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least:
1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses,
2. Associate each IP address with a single user agent and suite of cookies,
3. Associate each IP address with a particular target username,
4. Only attempt a few incorrect logins at a time, and a somewhat random (albeit realistic) number at that, within a given time interval,
5. Use random, apparently human delays between successive requests,
6. Issue requests using extremely high fidelity simulacra of web browsers, customized to the sequence and structure of HTTP requests on the website.
When the stakes are high this is the kind of opposition you'll get. Bank account takeover, social media account takeover, ticket scalping, automated sneaker buying, financial research, market research, etc.
Recaptcha introduces unpleasant user friction, but it usually works well. To invert a popular turn of phrase, it makes stopping simple attackers easy and hard attackers possible. The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them.
Technical sophistication is only one dimension of this game. The other is making adversaries spend more money than they can gain from being successful.
- mirimir 7y ago> automated sneaker buying ??? Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?
- mcpeepants 7y agoMost likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.
- ALittleLight 7y agoSeems like a market problem. Why not auction the sneakers?
- throwawaymath 7y agoTo be clear, I don’t have a horse in this particular race. I’m neither condemning nor condoning the market dynamics of sneaker arbitrage here. It’s just an example I’m very familiar with because I used to write scrapers and I’ve been offered silly amounts of money to make them for sneaker trading groups. Not as much as hedge funds will pay for writing crawlers for market research, but still more than you’d probably expect just so they can flip Supreme shirts and Yeezys faster than competitors. It’s ridiculous, but this is the world we live in. The point is simply that when the stakes are high (particularly when there is money to be made), stopping adversaries will be really, really difficult. Back to the point at hand, I don’t like recaptcha in principle. But given my view from both sides of the table, it’s one of very few things that consistently works for sophisticated adversaries. It’s about as close to a silver bullet as they come, with the additional upside that it’s the absolute easiest thing to implement - in both an absolute sense and relative to the return. And once you have, most of what you can implement beyond recaptcha has diminishing returns in comparison. All of that being said, I would be inclined to agree that most websites and apps don’t need recaptcha, simply because most of them aren’t worthwhile targets for the types of attacks recaptcha is singularly effective against.
- ackbar03 7y agoHedge fund paying for scrapers, is that a common thing these days? What kind of prices do they pay if I may ask?
- throwawaymath 7y agoExtremely common. Most hedge funds buy what's called "alternative data" from vendors who aggregate it, like 7Park. The data is collected by providers who collect it from location telemetry, web scraping, satellite imagery, etc. Scraping from web applications is one of the more common forms. The more successful quant funds will often build out internal research teams to do this. For example, both Two Sigma and Millennium have (not so well advertised) research teams devoted to this kind of data collection internally.
- mirimir 7y agoWhy don't they just sell more of them? Or as ALittleLight says, auction them? Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.
- chii 7y ago> Doesn't seem like the seller's responsibility. sounds like to me that the seller doesn't want the scalper to sell outside the official channels imho. It might dilute the brand as well.
- mirimir 7y agoWhy do "official channels" matter? They're just sneakers. And why brand dilution? Scalpers sell at a premium, not discounted.
- inetknght 7y agoExclusivity agreements are anti-competitive tbqh The real problem is supply. Popular tickets are scalped because there's only so many tickets. Then unpopular tickets are scalped because it was so easy to scalp the popular ones. There's only so many sneakers that can be made: making more chews up the supply chain for something which isn't _truly_ being consumed.
- dillonmckay 7y agoThe rapper Post Malone released a custom collaboration with Crocs and the shoe sold out in 24 hours, reselling on eBay for several hundred dollars. https://www.digitalmusicnews.com/2018/11/02/post-malone-crocs/ https://www.digitalmusicnews.com/2018/11/02/post-malone-croc...
- WillPostForFood 7y agoRotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses How are they getting residential IP addresses, compromised PCs?
- hombre_fatal 7y agohttps://luminati.io/#pricing https://luminati.io/#pricing
- chii 7y agoHow the hell do they get people to open up their home computer to be used this way?
- Zak 7y agoUsers of free mobile apps (mostly games) are offered the option of allowing use of their devices as proxies as an alternative to being interrupted by ads. https://luminati.io/faq https://luminati.io/faq
- AstralStorm 7y agoExcellent, a new botnet to exploit. ;)
- jsnell 7y agoThey pay developers to include the Luminati "SDK" (their euphemism for malware) in popular apps.
- stordoff 7y agoThey encourage developers to include their SDK: > Monetize your mobile app or game with our SDK, without showing intrusive ads or requiring annoying subscriptions and in app purchases. https://luminati.io/sdk https://luminati.io/sdk They approached nmap of all people: > Hi, > My name is Lior and I'd like to offer you a new way to make money off your software. The Luminati SDK provides your users the option to use your software for free by contributing to the Luminati proxy network. > We will pay you $3,000 USD a month for every 100K daily active users. > No collection of users' data, no disruption of user experience. > I'd like to schedule a 15 minute call to let you know how we can start. Are you available tomorrow at 12:30pm your local time? > Best regards, > Lior https://seclists.org/nmap-dev/2018/q1/27 https://seclists.org/nmap-dev/2018/q1/27
- raverbashing 7y agoSounds like big operations like that should have been putting people into jail
- sroussey 7y agoIf only.
- cf141q5325 7y ago>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them. You can also just pay people to solve recaptchas all day.
- qtplatypus 7y agoHowever that still contributes to security. If you make the expense of bypassing it greater then the worth of accessing the site then you have stopped them.
- throwawaymath 7y agoThat's what mechanical turk is.
- cf141q5325 7y agoThanks a lot for the correction. I blame the lack of coffee...