I managed to take down arbitrary posts on Hacker News

https://reverseengineeringtogether.wordpress.com/2022/10/18/how-i-managed-to-take-down-arbitrary-posts-on-hacker-news/

by lawgimenez • 4 years ago

34 24 4 years ago

reverseengineeringtogether.wordpress.com

metadat• 4 years ago

Nasty stuff, thanks for sharing it in the open.

Were they able to run each experiment with the same botnet? Or is a fresh one required every time?

lookagain• 4 years ago

Uphill battle, but okay.

legrande• 4 years ago

The IP has already registered not long ago
The IP comes from a known VPN provider
The IP comes from previously flagged locations

I noticed this when registering. Residential IPs are treated differently. You don't get shadow-banned at all with plain old vanilla IPs. In-fact you can make your first post under a residential IP, and it will show up in /newest and you don't have to wait in purgatory for about 5 days for it to show up.

One other option is to use a really obscure VPN service that not many people use and has a greater chance of not being on a blacklist, but that is rare. It's also rare to get a SOCKS5 proxy that isn't flagged as suspicious in some spam database.

Then there's the shady practice of using hacked residential routers to make your posts, but who does that?

xipho• 4 years ago

The punchline seems to be:

"the post, that after some hours vanished from the top page of Hacker News"

This doesn't sound any different than any other post on HN. I'm not sure the author really did anything?! They didn't say the post vanished completely, for example.

yieldcrv• 4 years ago

lowering the author’s credibility in the eyes of the algorithm.

This is one of the known flaws of Hackernews

It has a way of earning greater weight to users but if you fall out of that there is no way back in. It is easier to fall out when the account is new, a short string of negative karma or flags and that account is burned. Browser session as well. IP not as much but the mods do watch when an IP address eventually gets linked to a malbehaved user to apply greater scrutiny.

From their perspective this is fine, because people aren't that persistent. They don't have a way to quantify what an improved system looks like that allows for re-earning good standing, so to them there’s no rationale to develop that, as long as people just move on or stay shadowbanned talking to themselves forever.

Maursault8• 4 years ago

"I'm bored, have dubious ethics and absolutely no restraint whatsoever, so, unsolicited, I'm going to help your site security without notice of my attack! Look what I did! Pay attention to me!"

Looks like Hacker News owes this generous soul a massive debt of gratitude for all his hard work while they get familiar with U.S. Code Title 18 Section 1030, "Fraud and related activity in connection with computers."[1]

[1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

fragmede3• 4 years ago

Spot the fed was always a fun time at Defcon.

https://www.vice.com/en/article/ypw4wb/when-the-fbi-found-ou...

Maursault8• 4 years ago

Spot the paranoid or the gullible is a lot easier since Defcon isn't remotely on the radar of any federal agency, and the notion was only invented to increase interest and credibility. You seriously believe FBI Special Agents would attend Defcon? They have jobs.

edit: the 2015 FOIA request proved this. An FBI researcher pulled info off the web in 2001, no agents contacted the Vegas field office (which means no agents attended), the Vegas field office requested the case be closed, and it was. Read to me like someone in DC was playing a joke on the Vegas field office.

YeBanKo3• 4 years ago

If you ignore all the arrogant remarks from the post the take away is: relatively unsophisticated attacker can tank posts, harm users reputations and alter the state of the HN home page. It's not good, given the influence of HN in the community.

Maursault8• 4 years ago

It's unclear whether there was any effect at all.

aaron695• 4 years ago

I was surprised to learn that they actually had a decent algorithm for detecting possibly fraudolent and/or irrelevant content, as well as a weighted voting system, where the vote of a couple users with lots of karma are more important than hundreds of votes from low karma users.
votes of suspicious users are still displayed normally, even though they do not count as much as a normal user’s vote, if not at all.

That's interesting.

There are a few notable groups of bad actors on HN but obviously the really good ones you wouldn't know about, which is a bit of a teapot.

The lack of a downvote button on posts does stop a lot of attacks.

Interesting write-up. I don't think the final exploit leads the way to a useable hack, but the journey says a lot.

abrax3141• 4 years ago

Dude, couldn’t you have attacked one of your own posts?! Now I have a highly flagged post in my history and no karma to show for it!!

adultSwim• 4 years ago

I'm not sure how comfortable I am with this strain of research. I'm reminded of the University of Minnesota researchers who tried to see if they could get bad commits into Linux. I agree with encouraging us to widen our view of security to include gaming the system.

I managed to take down arbitrary posts on Hacker News

Related Stories