Attacks/Breaches
10/17/2013
01:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DDoS Attack Used 'Headless' Browsers In 150-Hour Siege

Distributed denial-of-service attack employed a browser app toolkit to simulate Web visitors accessing the victim's website

"Headless" browsers pummeled a trading platform's website this past week in a rare form of a distributed denial-of-service (DDoS) attack that lasted for 150 hours.

The attack employed some 180,000 IP addresses -- and as of today continues to rebound in smaller pockets -- according to cloud-based DDoS mitigation service provider Incapsula, which discovered and mitigated the massive attack for its customer.

The company declined to name the targeted organization, only saying it was a trading platform and that the attackers were likely motivated for competitive reasons. "The order of magnitude was significant," says Marc Gaffan, co-founder of Incapsula. "No one has 180,000 IPs at their disposal unless it's an amalgamation of separate botnets they are using interchangeably. This was a sophisticated and thought-out process."

DDoS attacks increasingly have moved up the stack to the application layer, mainly for more targeted purposes, such as disrupting transactions or access to databases. According to new data from Arbor Networks, DDoS attacks, in general, are getting more powerful, but their duration is declining: The average DDoS attack size thus far is 2.64 Gbps for the year, an increase of 78 percent from 2012, and some 87 percent of attacks last less than one hour.

That makes the recent headless browser attack even more unusual, given that its duration was so long. "That's pretty long. Obviously, someone was upset at them," says Marc Eisenbarth, manager of research for Arbor.

[DDoS attack sizes are rising even as the duration of the attacks grows shorter, according to Arbor Networks. See DDoS Attacks Grow Shorter But Pack More Punch.]

The attack also was unusual in that it employed a version of the Phantom JS headless browser toolkit, which is a Web app developer's tool for testing and simulating user browsing of an application. "This was the first time we saw this technology in a DDoS attack," Gaffan says. "It mimics human behavior so effectively that it's a challenge for mitigation services to deal with."

Phantom JS is basically a test tool that uses a bare-bones or "headless" browser -- no buttons, address bar, etc. -- with an API so programmers can test-run and automate their apps. "They can do a load test to websites simulating browser behavior and run JavaScript and accept cookies," for example, Gaffan says.

Arbor's Eisenbarth says he rarely sees Phantom JS being abused the way Incapsula has described this DDoS attack on its customer. "We don't see Phantom JS as much. What we do see are attackers creating hidden [Internet Explorer] browsers that actually are full-function browsers and are even more sophisticated at bypassing detection mechanisms," Eisenbarth says.

The attackers also employed some 861 different variants of the headless browser and were generating some 700 million hits per day on the targeted website, according to Incapsula. "It's really an evasion technique. We try to catch what they are doing, and they try to evade us," Gaffan says. "Our job is to filter out the good guys [legitimate visitors] and let them pass ... the site still needs to operate. And then keep the bad traffic out."

Dan Holden, director of security research at Arbor Networks, says these Layer 7 DDoS attacks take more effort to execute. "There's got to be something financial" motivating the attackers, he says. "These are more common when you've got very focused and targeted attacks."

Incapsula's Gaffan says application-layer DDoS attacks are becoming more popular and often accompany network-layer attacks. "That leaves you scrambling on all fronts," he says. "An application-layer attack is easier to perpetrate because it requires less resources, but you need expertise" to pull it off, he says.

The victim organization's business in the end suffered little impact since Incapsula was able to mitigate the attack, he says. But the DDoS hasn't disappeared yet, either: "It started last week, and to some extent, it's still ongoing," Gaffan says. "There's an ongoing process [by the attackers] of updating and changing" the headless browsers in the attack, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Listen Now Botnet Takedowns: Who's Winning, Who's Losing
Sara Peters hosts a conversation on Botnets and those who fight them.