Attackers explain how an anti-spam defense became an AI weapon.

You are viewing a single thread.
View all comments View context
2 points

How does this affect a genuine user who experiences a 404 on your site?

permalink
report
parent
reply
3 points
*

I don’t know a lot about this, but I would guess a normal user would like a message, that says something along the lines of “404, couldn’t find what you were looking for.” The status code and the links back to itself as well as the 13 MBs of noise should probably not irritate them. Hidden links should also not irritate normal users.

permalink
report
parent
reply
2 points

I also “don’t know a lot about this”, but I do know that your browser receiving a 200 means that everything worked properly. From what I can tell, this technique is replaces any and every 404 response with 200, thus tricking the browser (and therefore the user) into thinking the site is working as expected every time they run into a missing webpage on this site.

permalink
report
parent
reply
3 points

The user doesn’t see the status code, they see what’s rendered to the screen.

permalink
report
parent
reply
1 point

They will see a long string of base64 that takes a quarter of a second longer to load then a regular page. If it’s important to you, you can make the base64 string invisible and add some HTML to make it appear as a normal 404 page.

permalink
report
parent
reply

Pulse of Truth

!pulse_of_truth@infosec.pub

Create post

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Community stats

  • 1.3K

    Monthly active users

  • 1.5K

    Posts

  • 1.2K

    Comments

Community moderators