Potential abuse of chat oneboxing to cause users to consume excessive bandwidth

bwDraco

Sep 13, 2016 00:58

I try to keep all GIFs under 20 MB. Anything larger than this will be posted as a GIFV.

Bob

@bwDraco If we're talking about those posted to chat... I'd suggest 10 MB or even 5 MB.

bwDraco

Okay.

Bob

Personally, I think 2 MB is about as big as oneboxed data should go.

bwDraco

I do check GIF sizes before posting.

Bob

Problem is people on mobile...

bwDraco

Sep 13, 2016 01:01

I'll limit to about 5-10MB in the future. (I did post a 16MB GIF a while back.)

Bob

It doesn't even affect me personally anymore cause I now have more mobile data than I know what to do with.

But... others here aren't that lucky

bwDraco

It's not an issue for me even if I'm on LTE but about 15-20MB is as much as I'll accept.

Bob

@bwDraco I really think this is a problem that SE should fix, but they've not done so yet. Bleh.

bwDraco

There ought to be click to play.

Bob

@bwDraco Consider a fairly typical monthly data cap is something like... 1 GB. Maybe 2-3 on the higher end.

That gives you some 30-100 MB per day.

Using a good chunk of that (involuntarily) on a single image... :S

bwDraco

Sep 13, 2016 01:04

I have 3 GB and generally don't even hit 1 GB, but I realize some folks have very limited data allowances.

Bob

Yea, I'd prod slightly with a "try to keep it down" with something in your <20 MB (<10 MB?) range, but more than that and I'll start moving them out of the room if I see them.

@bwDraco tbh I'm not entirely sure what's normal in US, UK or EU.

Ben N

Heh, I just stumbled upon your MSE request for click-to-play

Bob

I do know @DavidPostill has rather limited data even at home :\

@BenN Yea, I think I asked that after someone posted an 80 MB gif -_-

bwDraco

Oct 17 '15 at 18:57, by DragonLord

@tereško Sorry, but I have to flag this for mod attention. The animated GIF is 73 MB in size, which is dragging my connection down.

Bob

There's also the potential for abuse. Someone could maliciously post a 200 MB GIF :O

bwDraco

Sep 13, 2016 01:07

(200 MB is the limit for Imgur)

Bob

Of course, that'd probably be followed pretty quick by a banhammer (if malicious), but not until it's had an impact :\

@BenN This one?

8

Q: Can we make oneboxing optional on mobile chat?

As the title says. It'd be nice to have oneboxing optional on mobile chat, especially if it were something like click/tap-to-reveal. Why? Well... my data plan is crying at the tens-of-MB GIFs that get posted now and then. Related: Add support for .gifv format in chat onebox One of the recent...

bwDraco

Anyone with a server with sufficient storage and bandwidth can post images of arbitrary size. I could easily post a multi-GB GIF on one of my servers and link to it if I wanted to.

Bob

Huh, there's GreaseMonkey for FF Mobile now

bwDraco

That's the problem. Once you think about it from the standpoint of an attacker, it becomes readily apparent that this can be an DoS attack vector against SE chat users.

Bob

I could do click-to-reveal in a userscript :D

bwDraco

Sep 13, 2016 01:10

...and this is why I need to learn JS.

Bob

Hm. Either intercept chat code or do it on DOM mod... the latter might be too late? I wonder if removing the img stops the load.

Eh... if I remember when I get home, I'll try.

bwDraco

@Bob Mind if I add to your post describing security implications?

Journeyman Geek

ehhhh. Unless you're on mobile or have a super limited data plan...

DDOS is a bit of an extreme way to describe it

bwDraco

Not DDOS. DOS.

Journeyman Geek

same difference. Still extreme.

Bob

Sep 13, 2016 01:15

@bwDraco Go ahead.

Journeyman Geek

unrelatedly, I'm starting work tommorrow. I think tommorrow is 9-6, but I donno after that...

so any pings during office hours are likely to get responded to much later.

Bob

@JourneymanGeek What do you count as super limited, though?

1 GB is common (less than that is still common...). A single 200 MB gif is a good chunk of it.

Journeyman Geek

@Bob a gig or two I guess. I've almost never had a wired broadband connection with restrictions.

Bob

I suppose you could say people in RA are more likely to have greater limits.

But, hey... I was on 1-1.5 GB for a few years.

Journeyman Geek

but I think the term DOS is inappropriate here. I suggest "PITA" AKA "My Donkey has agony internally"

Bob

Sep 13, 2016 01:17

IIRC @DavidPostill has 5 GB across all devices (tethered?)

bwDraco

@Bob Done.

Journeyman Geek

(just for the record, I think click to play/hiding oneboxes is a good idea)

Bob

@JourneymanGeek Eh... I think DoS actually describes the malicious actor case pretty well.

Journeyman Geek

but not everyone is malicious.

bwDraco

8

Q: Can we make oneboxing optional on mobile chat? (Potential security exploit!)

As the title says. It'd be nice to have oneboxing optional on mobile chat, especially if it were something like click/tap-to-reveal. Why? Well... my data plan is crying at the tens-of-MB GIFs that get posted now and then. Related: Add support for .gifv format in chat onebox One of the recent...

feature-request chat mobile-web onebox security

Journeyman Geek

Sep 13, 2016 01:18

I for one don't always check the size of the gifs and other images I post.

Ben N

@Bob Yep, that's the one!

Journeyman Geek

If I THINK its large or know its large, sure I > it and mention its big

Bob

@JourneymanGeek Never said everyone is... just thought the potential was there.

@bwDraco -- not sure I like having that in the title :P

That Brazilian Headless Horse

@JourneymanGeek I did. The last one I posted I reduced from 22MB to 800KB.

Ben N

The new title might be editorialized just a little much for my taste

bwDraco

Sep 13, 2016 01:20

Edited out.

Ben N

Also, sorry about the time I oneboxed a 180MB GIF - I didn't know it was so huge!

That Brazilian Headless Horse

!!wat

ChatBot John Cavil

Journeyman Geek

@BenN which is why I followed the whole line of "this seems an extreme term"

;p

Wouldn't "this could be a potential security exploit" be better as a comment?

Bob

Back in a bit

Pc just died

bwDraco

Sep 13, 2016 01:21

> This has security implications because an attacker can post an image of arbitrary size on any server with sufficient storage and bandwidth and link to it on chat. Because chat automatically loads direct image links from any source, one could, with relative ease, post multi-GB animated GIFs and quickly exhaust user data allowances, effectively denying service to chat users.

Journeyman Geek

0_0

bwDraco

This is especially true if the attacker is using a CDN for the image, which isn't exactly expensive.

Journeyman Geek

ehhhh. You're overthinking it

bwDraco

Can't help to think about it from an attacker's standpoint.

That's just how security experts think.

Journeyman Geek

True, but we have a reasonably robust defence too

bwDraco

Sep 13, 2016 01:24

Not that I'm an actual hacker but I've taken a computer hacking course and know about this.

Journeyman Geek

an attacker would need at least 20 rep, and you can usually get a mod's attention within a few hours

Ben N

ROs should be able to take care of such shenanigans too

Bob

@JourneymanGeek Eh. We've seen ... questionable... users in here.

Journeyman Geek

they can kick but... not edit?

Bob

Anyway, that was all from a bit of a random thought => chat.stackexchange.com/transcript/message/32277076#32277076

@JourneymanGeek Nah, move the message.

Journeyman Geek

Sep 13, 2016 01:26

@BenN barrier of entry is higher

the hard part is getting the 'right' mod

Bob

@JourneymanGeek read the scrollback a bit :P

I think I said above - I'd probably move (to trash?) anything > 20 MB if I see it

Ben N

Deleting/moving messages ought to do it, right?

bwDraco

I might be ready to become a room owner but not 100% sure at this point.

Journeyman Geek

(locals, mods familiar with the channel - I'd trust jokerdino or terdon to do the right thing, but we've had some non local mods overracting in the past)

@BenN moving the messages takes care of the immediate issue

Bob

@JourneymanGeek The problem is "a few hours" is long enough for a fair bit of damage.

Journeyman Geek

Sep 13, 2016 01:27

not the person causing the issue

Bob

And we're talking monetary damage here...

bwDraco

^^^ This.

Bob

I've seen charges of 4c/MB, 5c/MB

200 MB can cost $8

Journeyman Geek

@Bob I was thinking the prospect of someone posting a bunch of large gifs maliciously ._.

Once again tho, I think click to view is a good idea

Ben N

Oh, but when it comes to getting 20 rep, you don't actually have to earn anything

Journeyman Geek

Sep 13, 2016 01:29

Just not the whole .... "OMG PEOPLE COULD ABUSE IT, PANIC..."

Ben N

Just associating 20 accounts together will do the job

Journeyman Geek

@BenN nope

Bob

@JourneymanGeek Whether malicious or not, there's the potential for that damage. Malicious could be much worse - they could post far more...

Journeyman Geek

you need it on one site

Ben N

I saw a user in here a while back who had 1 rep everywhere

Journeyman Geek

Sep 13, 2016 01:29

and proper earned rep (but association needs 200 anyway)

Bob

@JourneymanGeek You're kinda exaggerating the reaction there.

Journeyman Geek

@Bob ehhh, Maybe I'm assuming @bwDraco is overreacting...

Bob

It's not so much "INSTANT PANIC".

It's "This could happen. If it happens, it's bad. Please fix it."

2

bwDraco

^ Yup.

Bob

@JourneymanGeek ...y'know, I agree with him here. Heck, I brought it up first -_-

Journeyman Geek

Sep 13, 2016 01:31

Maybe I'm overreacting to the prospect of over reacting. or playing the feline's advocate...

Ben N

Also relevant: meta.stackexchange.com/questions/253487/…

Bob

This doesn't even affect me personally anymore. I don't really have a reason to panic. I have some 50 GB now...

But I still want to see this fixed, cause it could seriously affect other users.

That said... I'm somewhat regretting bringing this up in chat/meta now.

Journeyman Geek

@BenN wierd. Coulda sworn the requirement was per site...

@Bob meh, that's what they are for

Bob

Certain people who might or might not be here might or might not be the type to do this now that they know...

Journeyman Geek

I actually think its a good idea for other reasons, and asked about in the past.

I consider it a usability issue rather than a security one

Bob

Sep 13, 2016 01:33

@JourneymanGeek It's really both, IMO.

@JourneymanGeek The type of person to post random abusive spam is the type of person to do this.

Journeyman Geek

Yeah

Bob

@JourneymanGeek I think I said above - yea, we can probably clean up pretty quick. Yea, they'll probably be mod/banhammered pretty hard. But that's still enough time for damage.

Purely reacting is not really enough... it's a bit different from just saying something offensive.

At the moment, it's a hypothetical. I don't want to see it become a reality.

Journeyman Geek

yup

That Brazilian Headless Horse

@JourneymanGeek Apparently they can use 20 x 1rep meta.stackexchange.com/questions/253487/…

Journeyman Geek

yeah. I assumed they fixed that ._.

Potential abuse of chat oneboxing to cause users to consume excessive bandwidth

Root Access

Participants