Slashdot Mirror

← Back to Stories (view on slashdot.org)

Chrome Feature Helps Shield Websites From DDoS Attacks

Posted by Soulskill on from the anti-slashdotting dept.

An anonymous reader writes "Google has an interesting idea on how to take the edge off denial of service attacks. The latest developer builds of Chrome 12 have an option called 'http throttling,' which will simply deny a user access to a website once the browser has received error messages from the URL. Chrome will react with a 'back-off interval' that will increase the time between requests to the website. If there are enough Chrome requests flooding a website under attack, this could give webmasters some room to recover from a nasty DDoS attack."

58 of 86 comments (clear)

  1. Well... by The+MAZZTer · · Score: 4, Informative

    This is just to prevent ACCIDENTAL DoSing. You can turn it off with a command line switch, or simply use another browser or a dedicated DoSing tool.

    1. Re:Well... by icebike · · Score: 5, Insightful

      At best it might help with slashdotted sites.

      It does nothing for those sites under a true DOS attack, other than denying legitimate requests to that the DOS attack can continue unimpeded without those pesky legitimate requests sneaking through.

      --
      Sig Battery depleted. Reverting to safe mode.
    2. Re:Well... by Firehed · · Score: 1

      That's also relatively easy to block on the server side, since all of the requests will have the same referrer. Plus with some framebusting code, you can really screw with the website that's being used as the attack vector.

      --
      How are sites slashdotted when nobody reads TFAs?
    3. Re:Well... by Anonymous Coward · · Score: 1

      That's also relatively easy to block on the server side, since all of the requests will have the same referrer.

      That's assuming your bottleneck is at your webserver, not your network infrastructure/internet pipe.

    4. Re:Well... by alta · · Score: 2

      He's right... originally there was no way to turn it off until web developers bitched, me included, about how it's slowing down development. The problem was, as a developer i may reload a page often, or make a tweak, reload, etc. Waiting for this to clear was a bitch, so they put in the command line switch for us.

      You'd be surprised when tweaking code or css how often you reload a page.

      --
      Do not meddle in the affairs of sysadmins, for they are subtle, and quick to anger.
    5. Re:Well... by SQLGuru · · Score: 1

      You can bet I'll be disabling it / using a different browser when Woot throws up a Bag of Crap......

      But, yeah, were I being malicious, I'd be running my own code that spins up tons of requests once I find an error, not actually scaling them back.

    6. Re:Well... by postbigbang · · Score: 2

      It's meaningless. Browsers don't really participate in DDoS attacks; the attacks come from software that uses DNS reflection techniques to saturate TCP and other socket connections until load balancers fail, the servers are saturated, and everything has to time-out.

      Protections really don't involve browser back-offs, they relate to parsing source address data, then filtering those out so genuine traffic gets through, rather than traffic that saturates the sockets.

      --
      ---- Teach Peace. It's Cheaper Than War.
    7. Re:Well... by icebike · · Score: 1

      Protections really don't involve browser back-offs, they relate to parsing source address data, then filtering those out so genuine traffic gets through, rather than traffic that saturates the sockets.

      Exactly.

      And that can't really be done at EITHER end, (browser or web server), but cries out for a middle-ground approach that can detect DDOS attack signatures and kill them off close to the source rather than forwarding them all to the target's ISP to handle.

      The single ping flood is not the issue, and easily killed.

      The request that appears once every two minutes from hundreds of thousands or millions of bots is very hard to distinguish from real traffic, other than the bots don't want the traffic either, and usually work some sort of corruption on the request so that it does not clog their own tubes. If the botnet owner does not care about triggering a ton of inbound traffic to each bot they just run a seemingly normal web page request over and over. This increases their chances of being detected by the ISP or the user, but makes it very hard to detect at the target.

      --
      Sig Battery depleted. Reverting to safe mode.
    8. Re:Well... by Kagura · · Score: 1

      I'm sorry to anyone who read the summary, and I bet you're sorry, too. You and I are being trolled by a Slashdot editor for comments, even this post...

    9. Re:Well... by Anonymous Coward · · Score: 1

      DOS attack

      C:\>

    10. Re:Well... by Anonymous Coward · · Score: 1

      (disclosure: did not rtfa, this is perhaps just bullshit)

      Actually, I think the point is that they want to help prevent XSS DDOS: go to a high-volume forum, set a <img src="http://target.example.com/asdf"/> in your signature and wait until your friends' home server dies.

      Not how you take down Amazon, but that was never the subject. I think this has a nice, small, but nice, benefit. And no real downsides... I like it. :)

      (I used to have a server like this and when somebody hotlinked an image on a busy forum that alone was enough to slow it down to a crawl.. you know, plenty of people host their stuff on little 256kbit up pipes and that is plenty enough for 20/day hits. I like this! :D)

    11. Re:Well... by COMON$ · · Score: 1

      Good then I can still get my Banjo of Consternation from Woot.

      --
      CS: It is all sink or swim...oh and did I mention there are sharks in that water?
    12. Re:Well... by Dishevel · · Score: 1

      Well, this depends, are they talking about there browser (in which case, yes this would be nothing but a nuisance), or are they talking about sometime of apache like server side software under the name of Chrome? If so, no this is actually a pretty standard technique that should exist in servers these days.

      Where browser?

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    13. Re:Well... by LordLimecat · · Score: 1

      This is just to prevent ACCIDENTAL DoSing

      Noone in their right mind would attempt an intentional DDOS using a full-blown graphical web browser.

    14. Re:Well... by postbigbang · · Score: 1

      Seems so. The linked article is just as insane as the post. I guess I got sucked in.

      --
      ---- Teach Peace. It's Cheaper Than War.
  2. Who DDoSes with a browser? by gman003 · · Score: 4, Insightful

    Since dedicated DDoS programs like LOIC are readily available, nobody performs actual DDoS attacks with a browser. Hell, ping floods are more effective than a bunch of people pressing refresh too often.

    Now, this might reduce the Slashdot Effect, but not a DDoS.

    1. Re:Who DDoSes with a browser? by h4rr4r · · Score: 4, Interesting

      Judging by the amount of sites slashdot still manages to take down I disagree. Lots of unintentional DDoS still happening these days.

    2. Re:Who DDoSes with a browser? by blair1q · · Score: 1

      daps. you got there before i did.

      i wonder if posting a link to /. could be prosecutable as harassment by proxy.

    3. Re:Who DDoSes with a browser? by icebike · · Score: 1

      nobody performs actual DDoS attacks with a browser.
      Now, this might reduce the Slashdot Effect, but not a DDoS.

      Exactly.

      I seriously doubt Google designed this for what TFA says it does. TFA is too busy raking Google over the coals for not building in Do-Not-Track to even understand why this may be needed by legitimate sites who just happen to get slashdotted due to massive publicity or disasters.

      --
      Sig Battery depleted. Reverting to safe mode.
    4. Re:Who DDoSes with a browser? by betterunixthanunix · · Score: 1

      Where is that anti spam plan answer card? We need it here...

      --
      Palm trees and 8
    5. Re:Who DDoSes with a browser? by Sigma+7 · · Score: 1

      People might not use DDoS from a browser, but that doesn't prevent them from being used.

      For example, a certain URL redirection service loads a legit site in the iframe, while constantly reloading another site in an invisible frame.

    6. Re:Who DDoSes with a browser? by Anonymous Coward · · Score: 1

      That's because /. submitters usually link to their crappy little blogs instead of the original data sources that are often running on proper infrastructure. Slashdot has about 1 tenth the traffic that sights like Digg or Delicio.us have. The "Slashdot Effect" went away years ago...

    7. Re:Who DDoSes with a browser? by TubeSteak · · Score: 1

      Since dedicated DDoS programs like LOIC are readily available, nobody performs actual DDoS attacks with a browser.

      DDoS campaigns have been launched by telling people "go to this web page and leaving it open"
      The page is just a bunch of iframes reloading the target over and over.

      Just because Anonymous can rally the troops with the LOIC,
      doesn't mean that's how everyone else (or even anyone else) does it.
      Seriously, when was the last time you heard of the LOIC being used by a non-Anonymous group?

      --
      [Fuck Beta]
      o0t!
    8. Re:Who DDoSes with a browser? by chris_7d0h · · Score: 1

      And this helps how?
      If a site is overloaded, the service is denied to me. If *my* browser starts to "back off" it exacerbates the problem by increasing the outage I experience.
      A site is placed in the net to serve users content and if a user can't access it, then that person is per definition subject to Denial Of Service. A browser constructed with the described mechanism has a defect built in by design.

      --
      In a society that believes in nothing, fear becomes the only agenda ~ Bill Durodié
  3. "Don't Be Evil" Redux by dmmiller2k · · Score: 2

    Finally, some positive news about Google. Let's see how they muck it up now.

    --

    "No matter how cynical you get, it is impossible to keep up." -- Lily Tomlin

    1. Re:"Don't Be Evil" Redux by blair1q · · Score: 1

      Let's see how they muck it up now.

      By overselling the concept.

      It's a good way to keep one brand of browser from crapping on a website if something about it runs amok.

      But it's going to have almost no measurable effect on the incidence and severity of actual DDoS attacks.

    2. Re:"Don't Be Evil" Redux by sunderland56 · · Score: 1

      Let's see how they muck it up now.

      By overselling the concept.

      They already mucked it up by putting it in the wrong place. This would be a smart thing to build into Apache (or other web *server*) but pretty pointless to put in a web *browser*.

    3. Re:"Don't Be Evil" Redux by blair1q · · Score: 2

      The web server is way too high up the stack, and having it do the work is how the DDoS wants to hamstring you anyway.

      I was thinking that it should be distributed.

      See, in order to block incoming traffic, you have to accept the connection at the lower layers so you can decode it to determine that it's from the offending IP address. DoS long ago devolved to just doing SYN floods, since it's impossible to stop a SYN because you don't look at its contents before it's tied up your hardware almost as much as it can. A few thousand of those per second and you're not doing any business with anyone.

      So you tell your router block(src, dest). But that just makes your router the bottleneck. You need to push it out to all the routers that feed your router, and so on.

      And you need to do it for all the src addresses.

      So, in a world where all routers can handle blocks of this sort, the blocks propagate outward to the nodes and it's their routers blocking any traffic to your dest address, and the D in DDoS is no longer a problem.

  4. DOS maybe, but won't help for DDOS by GillyGuthrie · · Score: 1

    Distributed means from many sources. Attacks of this nature will not be affected by Chrome's mechanism. Chrome's feature will only prevent repeated requests from the same user. DOS attacks are blunted, not DDOS.

    1. Re:DOS maybe, but won't help for DDOS by Abstrackt · · Score: 1

      Many people run Chrome, right? It might not make much of a difference if a small percentage of a website's users are running Chrome but I wouldn't be surprised to see the other major browsers implement something similar.

      --
      They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
    2. Re:DOS maybe, but won't help for DDOS by sorak · · Score: 2

      Many people run Chrome, right? It might not make much of a difference if a small percentage of a website's users are running Chrome but I wouldn't be surprised to see the other major browsers implement something similar.

      I was thinking something similar. If Google could somehow convince Joe Sixpack that Firefox and IE are missing some valuable DDoS protection feature, then it would eventually be added to other browsers.

  5. Just a small part of the problem by Drakkenmensch · · Score: 2

    Do botnets even use browser attacks anymore? I was under the impression that most of these attacks were done with direct PING requests.

    1. Re:Just a small part of the problem by $RANDOMLUSER · · Score: 1

      No. A ping request only requires the server you're attacking to send a small packet back. For a DoS attack, you want to make the victim send a lot of bytes back to you, so a small script that repeatedly asks for a whole page, especially images, is the better way to go.

      <disclaimer.h>
      Or so I've heard...

      --
      No folly is more costly than the folly of intolerant idealism. - Winston Churchill
    2. Re:Just a small part of the problem by BitZtream · · Score: 4, Informative

      No, you don't use ICMP echo requests (and most other forms of ICMP), its too easy to filter upstream since it can safely be ruled out of the normal flow of traffic.

      While many ICMP packets are indeed useful and blocking ICMP in general is a really retarded thing that some less than clueful people like to do on firewalls (seen often here on slashdot) it will in general not screw proper traffic up too much if you block ICMP echo requests/replies upstream during a DDoS.

      If you want to do a proper DDoS, you have to make the traffic look like legitimate traffic so its indistinguishable from traffic the site actually wants so they can't easily block it.

      If you just try to ping -f me, I'll just call my upstream and tell them whats going on and ask them to drop it upstream to my address space until further notice.

      UDP dns queries are a good one to use as they can be spoofed and are pretty much impossible to block to a legitimate DNS server. TCP based connections like an HTTP request are more effective in the sense of the amount of traffic generated but are effectively unspoofable if you want to actually do more than a syn flood. If you can't spoof them then you become traceable and can be blocked since you're going to come from a specific address for each request, which can then be filtered, even if its a DDoS. Building a table of IPs to blackhole doesn't take long in most cases and can be pretty effective assuming your upstream firewalls/routers can handle the size of the blacklist, which may not be all that easy depending on the size and load of your upstream routers, but still far easier than dealing with a flood of legitimate looking UDP packets.

      I haven't seen an effective ping flood since 1998-99 on any thing but some little tiny sites that simply don't know what they are doing.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
  6. As a Haxx0r, this worries me by gazbo · · Score: 4, Funny
    When I launch DDoS attacks, I always VNC into my 300,000 zombies, load Chrome, and type the target's address into the URL bar of each one. This new feature will cripple me :(((((((

    On an unrelated note, I must remember to buy a replacement for my worn-out F5 key.

    1. Re:As a Haxx0r, this worries me by h4rr4r · · Score: 2

      Do what I do, once F5 wears out map it to other F-keys. That way you can use up all 12 of them before you have to get another keyboard.

    2. Re:As a Haxx0r, this worries me by nedlohs · · Score: 3, Funny

      But how will I view the help?

    3. Re:As a Haxx0r, this worries me by BitZtream · · Score: 1

      Get a keyboard with 20 F keys and don't remap F1?

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
  7. Re:WTF? by $RANDOMLUSER · · Score: 2

    What are you talking about? I always do my DDos attacks by repeatedly clicking the "reload" button on my browser. You never know when those GIFs in the browser cache are going to change.

    --
    No folly is more costly than the folly of intolerant idealism. - Winston Churchill
  8. This is similar to what I do. by blair1q · · Score: 5, Insightful

    I have an interesting way to stop muggers. I just don't mug anyone.

    Wait...

    1. Re:This is similar to what I do. by Talennor · · Score: 1

      And yet, by being more polite in public, you can demonstrate you are not a mugger, and we can better identify and deal with actual muggers.

      So while Chrome was not previously DDoSing servers, this action (that is more polite than just not DDoSing things), helps everybody out. Neat, eh?

      --

      //TODO: signature
  9. So, when someone nuclear bombs a website... by webbiedave · · Score: 4, Funny

    ... Chrome promises to throw less stones?

    1. Re:So, when someone nuclear bombs a website... by Compaqt · · Score: 1

      What I'd like to know is:

      If the site is so overloaded that it can't return a response, how can Chrome get the error message from the site?

      --
      I'm not a lawyer, but I play one on the Internet. Blog
  10. Re:Great idea, but by Corse32 · · Score: 2

    When you're trying to fix a 500 error caused by a script? Are you already getting this problem? I hadn't noticed anything when testing with Chrome...

  11. pointless and frustrating by ses4j · · Score: 1

    I personally hate this 'feature'. I don't understand what it defends against, because someone hitting refresh a few times in a browser is hardly a serious DoS attack. And it got in the way of me (and many others) the first time they rolled it out because the "DoS" it was defending against was me hitting my local test webserver which was returning a 500 because the page code was broken.

    1. Re:pointless and frustrating by ses4j · · Score: 3, Informative

      Here is the chromium issue, which was quite trafficy:

      Issue 66062: ERR_TEMPORARILY_THROTTLED makes web development difficult

      http://code.google.com/p/chromium/issues/detail?id=66062

  12. !Woot by metiscus · · Score: 2

    This is going to make it that much harder to get a bag of crap off of woot.

  13. Aw man by cforciea · · Score: 1

    Now I have to re-write my malware to some use other browser that may or may not be installed on the machine like Firefox.

  14. Re:going to change by TaoPhoenix · · Score: 1

    What if we DDOS the Russian Goatse copy that the recent crew of trolls is using? Maybe those links will start showing Unavailable instead?

    (Question for the Philosophy majors - what are the ethics of hacking a troll?)

    --
    My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
  15. Blizzcon. by Bengie · · Score: 1

    Remind me not to use Chrome when camping Blizzard for Blizzcon tickets.

  16. Yes, but... by digitalmonkey2k1 · · Score: 1

    This will only make it more difficult to get my Bandoleer of Carrots!

    --
    My sausage tree didn't grow, does that make me a bad mommy?
  17. I can think of at least one useful use-case by somepunk · · Score: 1

    It's hard to see this being much of an impact, even for stressed sites with a lot of Chrome users; people don't usually sit there mashing the refresh button when their page won't load. Most folk will actually implement their own"back-off" feature, Sure, there are outliers, but this is a game of big numbers and average statistics.

    Where this can help is with automated page loading. Your saved session has twenty tabs with pages from a single site? That's all loaded at once, in parallel in the browsers I know about. I imagine it can be a considerable load in some cases.

    --
    Those people who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)
  18. This Common Sense Idea... by Nom+du+Keyboard · · Score: 2

    This common sense idea brought to you by someone who runs a popular website and builds a browser.

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  19. More reason... by drb226 · · Score: 1

    ...to force everyone to use a CR-48? (insert holy war here)

  20. This feature isn't new ... by GNUALMAFUERTE · · Score: 1

    And it's not a feature, it's a bug. It's been in chrome for a while now, suddenly popped up overnight, and made life more complex to all developers. Do you have any idea of how hard it is to test a webapp if you can only get an error message once?

    It's a real piece of shit. I found a way to disable it, but it still pisses me off that google suddenly decided to implement such a stupid feature overnight, without warning, and without informing users of a way to disable it.

    This kind of protection should be implemented server-side. Relying in any way on the client is just braindead.

    --
    WTF am I doing replying to an AC at 5 A.M on a Friday night?
    1. Re:This feature isn't new ... by mobets · · Score: 1

      Someone else posted a link to the bug report on this. It looks like the feature was disabled at the end of January. Why are you still so angry about it? It appears they have taken all the previous complaints into account for this new release.

      --

      It was me, I did it, I moved your cheese
  21. Re:going to change by TaoPhoenix · · Score: 1

    You're just an AC, so you might not see this, but I'm working on some really wild counter-troll concepts. My original post meant a LOIC style event though.

    --
    My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
  22. Gee thanks! by existone · · Score: 1

    Now I will NEVER be able to get my bag of crap from woot using Chrome. Thanks for ensuring that... hah.