5 ms·

This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunnel

This reminds me of a nasty attack I learned about recently. I run http://unblock.us.org http://unblock.us.org, a DNS/anti-censorship server. Unblock does tunneling for censored websites. There are scripts out there that scan the whole internet for servers that accept HTTP and HTTPS requests to proxy. Those scripts are set up to simultaneously HTTP(S) GET tons of doubleclick.net etc. URLs to get the site owner kicked off Google Ads. I can imagine the black hat hackers selling their services for anyone willing to hurt a competitor's income. Obviously my server detects those attacks and blacklists them right away, but I was shocked at the ease of carrying that kind of attack. One day I really need to blog about all the shocking stuff going on online that I learned about by running a public service.

asax 12y ago
You really should - that sounds super interesting!
sleep-less 12y ago
How can your server blacklist requests to doubleclick.net?
- DonPellegrino 12y ago
  I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.
unclebucknasty 12y ago
>but I was shocked at the ease of carrying that kind of attack From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud. They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML. What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.

asax 12y ago

You really should - that sounds super interesting!

sleep-less 12y ago

How can your server blacklist requests to doubleclick.net?

DonPellegrino 12y ago
I don't tunnel HTTP/HTTPS requests to doubleclick.net at all to begin with (I use a whitelist for HTTP/HTTS), but if someone were to do too many DNS requests for the same domain in a short period of time I drop those requests as it means the Source IP I'm seeing is actually the IP of the victim of a DNS Amplification attack and sending them the response would make me a participant in that attack.

unclebucknasty 12y ago

>but I was shocked at the ease of carrying that kind of attack From affiliate marketing to PPC ad networks, etc., the implementing systems tend to be built as naively as possible. When you survey the implementations you quickly realize that the designers assume there are no bad actors in the known universe. Literally no thought was given to fraud. They generally tend to be wide open to abuse, and frequently through simple URL manipulation/automation and standard HTML. What's amazing is that billions of dollars are at stake, requiring little more than mouse-clicks. So, given that clicks are so insanely easy to simulate, you would think that these systems would be very robust; yet they are frequently the opposite. But, beyond the naivete, it is not entirely the networks' fault. They are locked in a never-ending game of cat-and-mouse with people who have very little to lose and much to gain.