search

ooni / backend

Everything related to OONI backend infrastructure: ooni/api, ooni/pipeline, ooni/sysadmin, collector, bouncers and test-helpers
BSD 3-Clause "New" or "Revised" License
50 stars 29 forks source link

Protect from malicious report submission #88

Open anadahz opened 8 years ago

anadahz commented 8 years ago

We should find a way to protect from intentionally or unintentionally malicious report submission that could saturate ooni-backend resources and end-up unable to process new reports requests.

87 could possibly help to counteract this problem and the current issue could help to solve https://github.com/TheTorProject/ooni-pipeline/issues/27 .

willscott commented 8 years ago

We can do an initial sanity check when using a domain-fronted collector to make sure reports are being submitted from the general location where they claim to be made.

Beyond that, i think we need to initially save stuff and look for unexplained spikes in activity after the fact to identify malicious reports (similar to how tor watches for bad relays coming on line)

anadahz commented 8 years ago

Ref. example: https://lists.torproject.org/pipermail/ooni-operators/2016-June/000003.html