Bitcoin Forum
December 08, 2016, 12:03:40 PM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: Who's the Spanish jerk draining the Faucet?  (Read 6318 times)
Gavin Andresen
Legendary
*
Offline Offline

Activity: 1652


Chief Scientist


View Profile WWW
August 04, 2010, 08:40:55 PM
 #1

I just shut down freebitcoins.appspot.com; it looks like somebody in Spain is being a jerk and getting a new IP address, bitcoin address, and solving the captcha.  Over and over and over again:

Code:
79.154.133.217 - - [04/Aug/2010:12:46:55 -0700]
"POST / HTTP/1.1" 200 1294 "https://freebitcoins.appspot.com/"
"Opera/9.80 (Windows NT 6.0; U; es-LA) Presto/2.6.30 Version/10.60,gzip(gfe)"

79.146.112.13 - - [04/Aug/2010:12:45:20 -0700]
"POST / HTTP/1.1" 200 1294 "https://freebitcoins.appspot.com/"
"Opera/9.80 (Windows NT 6.0; U; es-LA) Presto/2.6.30 Version/10.60,gzip(gfe)"

81.44.159.81 - - [04/Aug/2010:12:42:20 -0700]
"POST / HTTP/1.1" 200 1294 "https://freebitcoins.appspot.com/"
"Opera/9.80 (Windows NT 6.0; U; es-LA) Presto/2.6.30 Version/10.60,gzip(gfe)"
Those IP addresses all map to Telefonica de Espana.  If it was you:  give them back, please: 15VjRaDX9zpbA8LVnbrCAFzrVzN7ixHNsC

Now that 5 bitcoins is worth a fair bit, I'm thinking I need more cheating countermeasures.  I can think of four things to try:

1. Rate limit based on the first byte of the IP address (79. or 81. in this case).
2. Rate limit based on the USER-AGENT string ("Opera/9.8..." in this case).
3. Rate limit based on last two domains of reverse DNS lookup of the IP address (rima-tde.net in this case).
4. Make the standard amount given away 0.5 Bitcoins (Bitcoins have gone up 10 times in value since I started the Faucet).

If you get rate limited, you'll get a message that asks you to try again tomorrow.

BitcoinFX: thanks again for the donation to the faucet; I'm going to drain the Faucet below 500 coins temporarily, and will refill it with your donation after the new cheating countermeasures are in place.



How often do you get the chance to work on a potentially world-changing project?
1481198620
Hero Member
*
Offline Offline

Posts: 1481198620

View Profile Personal Message (Offline)

Ignore
1481198620
Reply with quote  #2

1481198620
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
knightmb
Sr. Member
****
Offline Offline

Activity: 308


Timekoin - Save Electricity, Don't Waste It!


View Profile WWW
August 04, 2010, 09:01:14 PM
 #2

This has been going on for a while I would say. I noticed that when I would donate BTC to it, I would check the site a few minutes later and it would be back down below 500 again very quickly (but not further down since it appears to stop after it reaches below 500)

I'm afraid with how the nature of Bitcoin works, even if you narrow it down to IP address, Bitcoin Address, cookies, browser string, etc. someone can still fake/change all of those to drain it.

I think your recommendation of 0.50 with it being reduced to the 0.05 when it hits below 500 BTC would work better to deter this kind of thing. Also, a rate per hour limit (because someone with a botnet could have all of them descend on it and empty it even at 0.05 a piece just for kicks)

It's obvious from your logs, the guy/gal was just renewing his IP address, generate a new bitcoin address, refresh the page, copy/paste new bitcoin address, send 5 BTC; rinse and repeat.

omegadraconis
Jr. Member
*
Offline Offline

Activity: 39


View Profile
August 04, 2010, 09:25:46 PM
 #3

You know the same thing crossed my mind that you could drain the faucet by grabbing a new ip address. I figured most of the people would be honest enough to not do it or there was something behind the scenes preventing it. One idea might be Browser finger print and a 81.x.x.x or 71.x.x.x limit. http://panopticlick.eff.org was something the eff did to show just how easy it is to finger print your browser (it checks your os build, Browser build, java, flash, other add-on versions, etc). If you were to combo detect the the browser id's and the first ip block it would be a fairly good way, though it would probably be a fair bit of work.

Another idea would be to add a delay to the coins being sent out, like say an hour after they are cleared the coin goes out. This wouldn't give someone instant satisfaction and would allow you to prevent the coins going out during that hour (Add a check to email yourself if a large number of transactions come through or something like that). Also dropping the coins being given out to 1 or 0.5 would significantly decrease the incentive of doing such a thing.

1HKYXgu9uLp8AQXabYrqbmAGqS73huNM7K
knightmb
Sr. Member
****
Offline Offline

Activity: 308


Timekoin - Save Electricity, Don't Waste It!


View Profile WWW
August 04, 2010, 09:54:21 PM
 #4

That's a really good idea, just make a queue system with a simple "click to approve" button.

I don't know how much traffic the faucet site gets though, might not be practical from a human standpoint, but I don't often see the faucet that far below 500 most of the time.

NewLibertyStandard
Sr. Member
****
Offline Offline

Activity: 252



View Profile WWW
August 04, 2010, 10:23:11 PM
 #5

I would make it give out 0.001% of the total bitcoins with a minimum of ฿0.02 and I would move those two decimal points to the left whenever the official client changes to displays another precision point. Thanks for the service, it's very useful to new users. I hope you can stay one step ahead of the cheaters.

Treazant: A Fullever Rewarding Bitcoin - Backup Your Wallet TODAY to Double Your Money! - Dual Currency Donation Address: 1Dnvwj3hAGSwFPMnkJZvi3KnaqksRPa74p
mizerydearia
Hero Member
*****
Offline Offline

Activity: 574



View Profile
August 04, 2010, 11:56:42 PM
 #6

Also dropping the coins being given out to 1 or 0.5 would significantly decrease the incentive of doing such a thing.

The incentive will always exist.  It just makes it harder/take longer, more effort and creativity involved.
skull88
Hero Member
*****
Offline Offline

Activity: 684



View Profile
August 05, 2010, 12:29:10 AM
 #7

What if they just use different proxy's, than the checking the first byte of the IP is useless.

You could make a registration form on the site where they first got to activate they're email address, and than get a login code.
After login than they can request the free coins, of course there is a limit of one request for one email address and you keep on checking the ip.

So if you want a lot of coins, you first got to register a lot of email adresses and than you got to register with all those addresses, you really got to have no life to do all that trouble just to drain down the Faucet Smiley

BTC: 1MifMqtqqwMMAbb6zr8u6qEzWqq3CQeGUr
LTC: LhvMYEngkKS2B8FAcbnzHb2dvW8n9eHkdp
FreeMoney
Legendary
*
Offline Offline

Activity: 1246


Strength in numbers


View Profile WWW
August 05, 2010, 12:41:10 AM
 #8

This is a nice exercise in what happens when you give free stuff away.

Hint: People try to get the free stuff.


I do think it's a nice idea, I'm not saying you shouldn't do it.

Play Bitcoin Poker at sealswithclubs.eu. We're active and open to everyone.
Anonymous
Guest

August 05, 2010, 01:32:56 AM
 #9

Whoever cheats to take free bitcoins wins this award.



It is the douche-bag of the year.
Gavin Andresen
Legendary
*
Offline Offline

Activity: 1652


Chief Scientist


View Profile WWW
August 05, 2010, 02:06:54 AM
 #10

Thanks for all the ideas!

First: I'm definitely going to drop from 5 BTC; I think I'll go all the way down to 0.50 BTC (rather than do 1 or 2).  Giving away a percentage of how much the faucet has is an interesting idea, but I want it to be as simple as possible.

Second: I really don't want to make getting coins from the Faucet a whole heavy-weight "register and check your email and yada yada yada."

But I do like the idea of adding an extra hurdle for 'suspicious-looking' behavior.  So I'm leaning towards doing some fuzzy browser fingerprinting combined with rate-limiting and, if you look suspicious or the fountain has been giving away a larger-than-usual number of coins, require that you login with your google account before getting any coins.  No google account: no coins.

It is hard to create lots of google accounts; they're requiring either phone or SMS account verification these days...

How often do you get the chance to work on a potentially world-changing project?
Gavin Andresen
Legendary
*
Offline Offline

Activity: 1652


Chief Scientist


View Profile WWW
August 05, 2010, 02:11:34 AM
 #11

This is a nice exercise in what happens when you give free stuff away.
Hint: People try to get the free stuff.
I do think it's a nice idea, I'm not saying you shouldn't do it.
Yeah, I shoulda anticipated problems when Bitcoins went from 0.005 USD each to 0.06 each.  If it takes somebody two minutes to go through the "get a new IP, get a new BC address, solve the captcha" process then they'd make 5*30=150 bitcoins an hour, which is $9 USD an hour, which, if you're unemployed, bored, and/or 13 years old is easy money.

How often do you get the chance to work on a potentially world-changing project?
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
August 05, 2010, 03:08:12 AM
 #12

This is a nice exercise in what happens when you give free stuff away.
Hint: People try to get the free stuff.
I do think it's a nice idea, I'm not saying you shouldn't do it.
Yeah, I shoulda anticipated problems when Bitcoins went from 0.005 USD each to 0.06 each.  If it takes somebody two minutes to go through the "get a new IP, get a new BC address, solve the captcha" process then they'd make 5*30=150 bitcoins an hour, which is $9 USD an hour, which, if you're unemployed, bored, and/or 13 years old is easy money.


Hmm, now that I think about it....13 years old would find bitcoins to be a money making opportunities, especially since they generally can't be employed by business and such. They can however, offer services and goods of some kind to bitcoiners in exchange for some money. When he/she saved up a bit, she/he can buy hosting services and bootstrap their way to bigger business operations.

Ground Loop
Member
**
Offline Offline

Activity: 112


View Profile
August 05, 2010, 04:30:59 AM
 #13

Sadly, I don't think there's a viable anti-abuse system when you have an automated system dispensing coins for free.  (anonymous, irrevocable coins)

The only countermeasure that makes sense is to slow down the value and pace of the whole faucet to where someone has a chance to manually keep an eye on flow.

But coming back to the roots of why it's neat, and what people reasonably get from it, the specific value is not really important.  I see it as more a "system test", where someone can watch coins come in, transfer them to another computer, and so on.  It's not supposed to be "what can I buy with these", but test coins.  Having 0.02 coins is much more fun than having zero.

To that end, a system that dispenses BTC 0.02 and has a significant delay (30 mins?) is less likely to be attractive to even automated abuse plots.

Bitcoin accepted here: 1HrAmQk9EuH3Ak6ugsw3qi3g23DG6YUNPq
BioMike
Legendary
*
Offline Offline

Activity: 1257


View Profile
August 05, 2010, 06:12:25 AM
 #14

I've tried it last week and got 0.05BC, which is fine for its purpose (testing how it works and if it works). I also send the same amount back. I think it works just fine like this. I wouldn't have tried it when I had to get a google account, or something similar (getting such thing for only 0.05BC is just to much effort for testing it).
gebler
Newbie
*
Offline Offline

Activity: 16


View Profile
August 05, 2010, 11:30:37 AM
 #15

Perhaps it would help to be more clear about the Faucet operating on an honor principle, and that no one is really allowed more than 5.05 bitcoins (or 0.55 bitcoins if you change it to that).  When I revisit the site today it says "Right now the rule is 0.05 bitcoins given per unique IP address."  Such language could be interpreted as if it was actually OK to get more payouts from the Faucet using several unique IP addresses, since it would not be "against the rules".  Improving the technical system to prevent cheating is probably a good idea anyway, since there are probably cheaters who don't care about being cheaters.  But some may actually think they are just being clever, maximizing their benefit without breaking any rules.

18h6HV7RPU4xFwiap2RdzsqDjcgsEmh3vy
tcatm
Sr. Member
****
Offline Offline

Activity: 337


View Profile
August 05, 2010, 02:09:51 PM
 #16

Just an idea... you could remove the message that tells the user he already got coins and always pretend to have sent coins when in reality you didn't. Maybe with a nice "If it doesn't work contact me at ..." message. Hopefully they'll just assume it's broken and don't bother trying to get coins from it anymore.
satoshi
Founder
Sr. Member
*
Offline Offline

Activity: 364


View Profile
August 05, 2010, 05:06:03 PM
 #17

Silently failing would look bad.

1. Rate limit based on the first byte of the IP address (79. or 81. in this case).
Definitely needed.  What rate are you thinking of?  Ultimately, it's better to rate limit it than to let it all drain out.

3. Rate limit based on last two domains of reverse DNS lookup of the IP address (rima-tde.net in this case).
That might work surprisingly well.  If it works, it keeps them from hitting the rate limit, but the rate limit is there as the last line of defence.

4. Make the standard amount given away 0.5 Bitcoins (Bitcoins have gone up 10 times in value since I started the Faucet).
Definitely time to lower it.
Bitquux
Member
**
Offline Offline

Activity: 117



View Profile
August 05, 2010, 07:58:25 PM
 #18

Switch to sending payment to IP addresses. They don't have to be static for this purpose. If you happen to miss it, too bad. Any unrelated person who happens to be at the requesting IP address probably sees tons of other random connection attempts from the Internet at large anyway.
knightmb
Sr. Member
****
Offline Offline

Activity: 308


Timekoin - Save Electricity, Don't Waste It!


View Profile WWW
August 05, 2010, 09:49:37 PM
 #19

Switch to sending payment to IP addresses. They don't have to be static for this purpose. If you happen to miss it, too bad. Any unrelated person who happens to be at the requesting IP address probably sees tons of other random connection attempts from the Internet at large anyway.
Can't do that with the current state of the software   Sad

hugolp
Hero Member
*****
Offline Offline

Activity: 742



View Profile
August 06, 2010, 10:40:51 AM
 #20

If he/she lives near me I can pay him a visit... just saying.  Roll Eyes
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!