5 ms·

I managed to take down arbitrary posts on Hacker News

34 points by lawgimenez 4y ago

metadat 4y ago
Nasty stuff, thanks for sharing it in the open. Were they able to run each experiment with the same botnet? Or is a fresh one required every time?
lookagain 4y ago
Uphill battle, but okay.
legrande 4y ago
> The IP has already registered not long ago > The IP comes from a known VPN provider > The IP comes from previously flagged locations I noticed this when registering. Residential IPs are treated differently. You don't get shadow-banned at all with plain old vanilla IPs. In-fact you can make your first post under a residential IP, and it will show up in /newest and you don't have to wait in purgatory for about 5 days for it to show up. One other option is to use a really obscure VPN service that not many people use and has a greater chance of not being on a blacklist, but that is rare. It's also rare to get a SOCKS5 proxy that isn't flagged as suspicious in some spam database. Then there's the shady practice of using hacked residential routers to make your posts, but who does that?
xipho 4y ago
The punchline seems to be: > "the post, that after some hours vanished from the top page of Hacker News" This doesn't sound any different than any other post on HN. I'm not sure the author really did anything?! They didn't say the post vanished completely, for example.
yieldcrv 4y ago
> lowering the author’s credibility in the eyes of the algorithm. This is one of the known flaws of Hackernews It has a way of earning greater weight to users but if you fall out of that there is no way back in. It is easier to fall out when the account is new, a short string of negative karma or flags and that account is burned. Browser session as well. IP not as much but the mods do watch when an IP address eventually gets linked to a malbehaved user to apply greater scrutiny. From their perspective this is fine, because people aren't that persistent. They don't have a way to quantify what an improved system looks like that allows for re-earning good standing, so to them there’s no rationale to develop that, as long as people just move on or stay shadowbanned talking to themselves forever.
Maursault 4y ago
"I'm bored, have dubious ethics and absolutely no restraint whatsoever, so, unsolicited, I'm going to help your site security without notice of my attack! Look what I did! Pay attention to me!" Looks like Hacker News owes this generous soul a massive debt of gratitude for all his hard work while they get familiar with U.S. Code Title 18 Section 1030, "Fraud and related activity in connection with computers."[1] [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- cactus-bussin 4y ago
- fragmede 4y ago
  Spot the fed was always a fun time at Defcon. https://www.vice.com/en/article/ypw4wb/when-the-fbi-found-out-about-def-cons-spot-the-fed-contest https://www.vice.com/en/article/ypw4wb/when-the-fbi-found-ou...
  - Maursault 4y ago
    Spot the paranoid or the gullible is a lot easier since Defcon isn't remotely on the radar of any federal agency, and the notion was only invented to increase interest and credibility. You seriously believe FBI Special Agents would attend Defcon? They have jobs. edit: the 2015 FOIA request proved this. An FBI researcher pulled info off the web in 2001, no agents contacted the Vegas field office (which means no agents attended), the Vegas field office requested the case be closed, and it was. Read to me like someone in DC was playing a joke on the Vegas field office.
    - popcalc 4y ago
      I met almost a dozen folks at DC this year who introduced themselves to me as working for a federal agency...
      - Maursault 4y ago
aaron695 4y ago
> I was surprised to learn that they actually had a decent algorithm for detecting possibly fraudolent and/or irrelevant content, as well as a weighted voting system, where the vote of a couple users with lots of karma are more important than hundreds of votes from low karma users. > votes of suspicious users are still displayed normally, even though they do not count as much as a normal user’s vote, if not at all. That's interesting. There are a few notable groups of bad actors on HN but obviously the really good ones you wouldn't know about, which is a bit of a teapot. The lack of a downvote button on posts does stop a lot of attacks. Interesting write-up. I don't think the final exploit leads the way to a useable hack, but the journey says a lot.
deleted 4y ago
[deleted]
abrax3141 4y ago
Dude, couldn’t you have attacked one of your own posts?! Now I have a highly flagged post in my history and no karma to show for it!!
adultSwim 4y ago
I'm not sure how comfortable I am with this strain of research. I'm reminded of the University of Minnesota researchers who tried to see if they could get bad commits into Linux. I agree with encouraging us to widen our view of security to include gaming the system.

34 points by lawgimenez 4y ago

Nasty stuff, thanks for sharing it in the open. Were they able to run each experiment with the same botnet? Or is a fresh one required every time?

lookagain 4y ago

Uphill battle, but okay.

legrande 4y ago

> The IP has already registered not long ago > The IP comes from a known VPN provider > The IP comes from previously flagged locations I noticed this when registering. Residential IPs are treated differently. You don't get shadow-banned at all with plain old vanilla IPs. In-fact you can make your first post under a residential IP, and it will show up in /newest and you don't have to wait in purgatory for about 5 days for it to show up. One other option is to use a really obscure VPN service that not many people use and has a greater chance of not being on a blacklist, but that is rare. It's also rare to get a SOCKS5 proxy that isn't flagged as suspicious in some spam database. Then there's the shady practice of using hacked residential routers to make your posts, but who does that?

xipho 4y ago

The punchline seems to be: > "the post, that after some hours vanished from the top page of Hacker News" This doesn't sound any different than any other post on HN. I'm not sure the author really did anything?! They didn't say the post vanished completely, for example.

yieldcrv 4y ago

> lowering the author’s credibility in the eyes of the algorithm. This is one of the known flaws of Hackernews It has a way of earning greater weight to users but if you fall out of that there is no way back in. It is easier to fall out when the account is new, a short string of negative karma or flags and that account is burned. Browser session as well. IP not as much but the mods do watch when an IP address eventually gets linked to a malbehaved user to apply greater scrutiny. From their perspective this is fine, because people aren't that persistent. They don't have a way to quantify what an improved system looks like that allows for re-earning good standing, so to them there’s no rationale to develop that, as long as people just move on or stay shadowbanned talking to themselves forever.

Maursault 4y ago

"I'm bored, have dubious ethics and absolutely no restraint whatsoever, so, unsolicited, I'm going to help your site security without notice of my attack! Look what I did! Pay attention to me!" Looks like Hacker News owes this generous soul a massive debt of gratitude for all his hard work while they get familiar with U.S. Code Title 18 Section 1030, "Fraud and related activity in connection with computers."[1] [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

cactus-bussin 4y ago
fragmede 4y ago
Spot the fed was always a fun time at Defcon. https://www.vice.com/en/article/ypw4wb/when-the-fbi-found-out-about-def-cons-spot-the-fed-contest https://www.vice.com/en/article/ypw4wb/when-the-fbi-found-ou...
- Maursault 4y ago
  Spot the paranoid or the gullible is a lot easier since Defcon isn't remotely on the radar of any federal agency, and the notion was only invented to increase interest and credibility. You seriously believe FBI Special Agents would attend Defcon? They have jobs. edit: the 2015 FOIA request proved this. An FBI researcher pulled info off the web in 2001, no agents contacted the Vegas field office (which means no agents attended), the Vegas field office requested the case be closed, and it was. Read to me like someone in DC was playing a joke on the Vegas field office.
  - popcalc 4y ago
    I met almost a dozen folks at DC this year who introduced themselves to me as working for a federal agency...
    - Maursault 4y ago

aaron695 4y ago

> I was surprised to learn that they actually had a decent algorithm for detecting possibly fraudolent and/or irrelevant content, as well as a weighted voting system, where the vote of a couple users with lots of karma are more important than hundreds of votes from low karma users. > votes of suspicious users are still displayed normally, even though they do not count as much as a normal user’s vote, if not at all. That's interesting. There are a few notable groups of bad actors on HN but obviously the really good ones you wouldn't know about, which is a bit of a teapot. The lack of a downvote button on posts does stop a lot of attacks. Interesting write-up. I don't think the final exploit leads the way to a useable hack, but the journey says a lot.

deleted 4y ago

[deleted]

abrax3141 4y ago

Dude, couldn’t you have attacked one of your own posts?! Now I have a highly flagged post in my history and no karma to show for it!!

adultSwim 4y ago

I'm not sure how comfortable I am with this strain of research. I'm reminded of the University of Minnesota researchers who tried to see if they could get bad commits into Linux. I agree with encouraging us to widen our view of security to include gaming the system.