4 ms·

We already tag/drop all Tor and VPN traffic. Cookies don't make much sense because this looks like browser automation, not someone just swapping VPNs by hand re

by ev1 6y ago

We already tag/drop all Tor and VPN traffic. Cookies don't make much sense because this looks like browser automation, not someone just swapping VPNs by hand repeatedly. For IP bans, they are now using illegitimately acquired or fraudulent IP space (the guy is not intelligent enough for this, he's almost certainly just buying proxies with in-game gold or some BS - but there is a criminal element here), including what might involve significant hijacking of AT&T, CenturyLink, Level3, and Windstream network resources. (if you work at one of those places and are clueful, I would be very interested in asking about this)

huhtenberg 6y ago
Try the basics first, i.e. hiding of the posts from new accounts, IP and cookie blacklisting. See if it works. Then move on to more advanced stuff, e.g. browser fingerprinting and behavioral pattern matching. If it's automated, there'll be a pattern. But the basic stuff can go a very long way. As a bonus, you can put all new accounts into a single group, so that they would see each other posts, but without making these posts visible to the approved accounts.
kbuck 6y ago
If you're seeing connections from random residential IPs, they're probably using a reverse-proxy service like Luminati or 911.re. IP blocklists won't catch these. These proxies originate from (basically) compromised computers -- people who install "free" browser extensions and the like: https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr... With a troll this persistent (and willing to spend money on it), your best bet is definitely shadow bans and moderation queues.
- ev1 6y ago
  It isn't just random residential IPs, but what appears to be BGP hijacking of/onto residential networks on top of that.
  - bawolff 6y ago
    What's the basis for assuming BGP hijacking? That would be very sophisticated attack to just troll some random website.
    - ev1 6y ago
      The skid is not the one doing it. They are buying from semi-professional "proxy sellers" that do it and then sell you some form of authenticated squid proxy that further makes the request.
      - GoblinSlayer 6y ago
        Can't he fake the source IP address by sending raw packets? Are they sanitized in any way?
        dnet 6y ago
        That wouldn't work for HTTP(S) or anything else that works over TCP since the reply would go towards the fake source IP address, thus the attacker couldn't even get past the 3-way TCP handshake.
  - stickfigure 6y ago
    Can you elaborate? If the troll is using residential proxies, you might try abuse@ the handful of services that offer such things. There aren't that many. I don't know if they actually take abuse seriously, but it can't hurt. Luminati has an abuse form: https://luminati.io/report-abuse https://luminati.io/report-abuse
adrr 6y ago
Use js fingerprint library. Ban on the fingerprints. Black list the whole provider if it came from a hosting provider. You’ll end up blacklisting real users so you’ll need to ability to whitelist. WebRTC used to be able to pierce proxies to get the real IP via STUN, could try that. You could also check ttl on tcp protocol to see if it’s going through a proxy or client is lying on the user agent header. There’s more stuff on the client you can do to prevent attackers from just hitting your APIs and forcing them to run a full client with having client solve sort a problem that it needs to provide to the API. You can detect headless browsers as well in JavaScript with a few open source bot detector JavaScript libraries.
tdrp 6y ago
By the way how do you detect VPN traffic? For tor we just pick up the list of exit nodes but we've had trouble identifying VPN without using a 3rd party API.
- fomine3 6y ago
  I know a site just banning a IP opening 443/tcp. It bans web server and possibly ssl-vpn server, but causes false positives.
  - soupsranjan 6y ago
    we are a stealth startup founded by former Paypal and Coinbase engineers. We have a device intelligence product that can detect accesses from proxies/VPNs without using any IP list. We can also detect the True OS that someone is using - useful to detect emulators and script kiddies. Happy to chat if of interest: info AT sardine.ai
    - deleted 6y ago
      [deleted]
- toast0 6y ago
  You can pick up a lot of VPNs by checking the ASN. If it's a hosting company, chances are it's a VPN or a bot. Doesn't work for the VPNs that get you on residential IPs though.
- malinens 6y ago
  maxmind has anonymous IP DB. it costs money
  - alam2000 6y ago
    You can use the IP2Proxy database. It is cheaper compare to Maxmind.

by ev1 6y ago

huhtenberg 6y ago

Try the basics first, i.e. hiding of the posts from new accounts, IP and cookie blacklisting. See if it works. Then move on to more advanced stuff, e.g. browser fingerprinting and behavioral pattern matching. If it's automated, there'll be a pattern. But the basic stuff can go a very long way. As a bonus, you can put all new accounts into a single group, so that they would see each other posts, but without making these posts visible to the approved accounts.

kbuck 6y ago

If you're seeing connections from random residential IPs, they're probably using a reverse-proxy service like Luminati or 911.re. IP blocklists won't catch these. These proxies originate from (basically) compromised computers -- people who install "free" browser extensions and the like: https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/shining-a-light-on-the-risks-of-holavpn-and-luminati https://www.trendmicro.com/vinfo/hk-en/security/news/cybercr... With a troll this persistent (and willing to spend money on it), your best bet is definitely shadow bans and moderation queues.

ev1 6y ago
It isn't just random residential IPs, but what appears to be BGP hijacking of/onto residential networks on top of that.
- bawolff 6y ago
  What's the basis for assuming BGP hijacking? That would be very sophisticated attack to just troll some random website.
  - ev1 6y ago
    The skid is not the one doing it. They are buying from semi-professional "proxy sellers" that do it and then sell you some form of authenticated squid proxy that further makes the request.
    - GoblinSlayer 6y ago
      Can't he fake the source IP address by sending raw packets? Are they sanitized in any way?
      - dnet 6y ago
        That wouldn't work for HTTP(S) or anything else that works over TCP since the reply would go towards the fake source IP address, thus the attacker couldn't even get past the 3-way TCP handshake.
- stickfigure 6y ago
  Can you elaborate? If the troll is using residential proxies, you might try abuse@ the handful of services that offer such things. There aren't that many. I don't know if they actually take abuse seriously, but it can't hurt. Luminati has an abuse form: https://luminati.io/report-abuse https://luminati.io/report-abuse

adrr 6y ago

Use js fingerprint library. Ban on the fingerprints. Black list the whole provider if it came from a hosting provider. You’ll end up blacklisting real users so you’ll need to ability to whitelist. WebRTC used to be able to pierce proxies to get the real IP via STUN, could try that. You could also check ttl on tcp protocol to see if it’s going through a proxy or client is lying on the user agent header. There’s more stuff on the client you can do to prevent attackers from just hitting your APIs and forcing them to run a full client with having client solve sort a problem that it needs to provide to the API. You can detect headless browsers as well in JavaScript with a few open source bot detector JavaScript libraries.

tdrp 6y ago

By the way how do you detect VPN traffic? For tor we just pick up the list of exit nodes but we've had trouble identifying VPN without using a 3rd party API.

fomine3 6y ago
I know a site just banning a IP opening 443/tcp. It bans web server and possibly ssl-vpn server, but causes false positives.
- soupsranjan 6y ago
  we are a stealth startup founded by former Paypal and Coinbase engineers. We have a device intelligence product that can detect accesses from proxies/VPNs without using any IP list. We can also detect the True OS that someone is using - useful to detect emulators and script kiddies. Happy to chat if of interest: info AT sardine.ai
  - deleted 6y ago
    [deleted]
toast0 6y ago
You can pick up a lot of VPNs by checking the ASN. If it's a hosting company, chances are it's a VPN or a bot. Doesn't work for the VPNs that get you on residential IPs though.
malinens 6y ago
maxmind has anonymous IP DB. it costs money
- alam2000 6y ago
  You can use the IP2Proxy database. It is cheaper compare to Maxmind.