Yesterday we mitigated a unique application layer DDoS attack against one of our clients. The attack was carried out using traffic hijacking techniques, which flooded our client with over 20 million GET requests originating from the browsers of over 22,000 Internet users – all turned into unwilling accomplices by the offender.
What makes this case especially interesting is the fact that the attack was enabled by a vulnerability in one of the world’s largest and most popular sites – one of the domains on Alexa’s ‘Top 50’ list.
We can’t disclose the domain name in question at this time, as our team is now working to resolve the breach. However, we will provide further details, once the vulnerability is fixed.
Having said that, we can already describe the method used by the attackers, in the hopes that it will help prevent similar abuse of other websites.
Persistent XSS Enables Large-Scale DDoS Attack
The site in question is a high profile video content provider, which allows its users to sign in with their own profiles. The DDoS attack was enabled by a persistent XSS vulnerability that allowed the offender to inject JavaScript code into the <img> tag associated with the profile image. As a result, every time the image was used on one of the the site’s pages (e.g., in the comment section), the malicious code was also embedded inside, waiting to be executed by every future visitor to that page.
As a result, each time a legitimate visitor landed on that page, his browser automatically executed the injected JavaScript, which in turn injected a hidden <iframe> with the address of the DDoSer’s C&C domain. There, an Ajax-scripted DDoS tool hijacked the browser, forcing it to issue a DDoS request at a rate of one request per second.
Obviously one request per second is not a lot. However, when dealing with video content of 10, 20 and 30 minutes in length, and with thousands of views every minute, the attack can quickly become very large and extremely dangerous. Knowing this, the offender strategically posted comments on popular videos, effectively created a self-sustaining botnet comprising tens of thousands of hijacked browsers, operated by unsuspecting human visitors who were only there to watch a few funny cat videos.
Intercepting the Attack
The attack was blocked by Incapsula’s progressive challenges and behavior-based security algorithms, made that much more effective by the predictable behavior of the DDoS tool. By intercepting the malicious requests, we were also able to track the source of the attack. We did this by replacing the content of the target URL with a snippet of our own JavaScript, which reported the original referral source – leading us to the abused video website.
We were then able to replicate the persistent XSS responsible for the attack. Once we had all of this information in hand, we quickly reached out to the site support team, offering our help in fixing the issue.
It should be noted that yesterday the original DDoS tool on the attacker’s C&C domain was replaced with a much more robust version. This leads us to believe that what we saw yesterday was a sort of POC test run. The current code is not only much more sophisticated, but it is also built for keeping track of the attack, for what seems like billing purposes. From the looks of it, someone is now using this Alexa Top 50 website to set up a chain of botnets for hire.
Update: April 24
No, it wasn’t YouTube
The disclosure of this vulnerability received extensive media coverage, which was accompanied by numerous attempts to guess the website’s identity. By far, the most popular assumption was that this story is about YouTube. While we wanted to debunk that rumor, we couldn’t allow ourselves to be drawn into a ‘twenty questions’ game, which would inevitably provide additional clues to the vulnerable website’s true identity.
Now, with the vulnerability patched, we can divulge that the site in question is Sohu.com (Chinese for ‘Search-fox”) – China’s 8th largest website and currently the 27th most visited website in the world.
While being relatively unfamiliar to Western audiences, Sohu is a local and global powerhouse. This rapidly growing $2.5 billion organization provides a variety of search and content solutions, including Sohu.TV – the video streaming service that enabled the DDoS attack to occur.
Once we uncovered the source of the browser-based DDoS attack and replicated persistent XSS vulnerability that allowed it to occur we immediately went on to share our findings with Sohu security team.
With this information in hand Sohu team could quickly evaluate the problem and respond with a rapid patch which fixed the security hole, rendering this browser-based botnet completely useless.
Try Imperva for Free
Protect your business for 30 days on Imperva.
