Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/17/2013
01:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DDoS Attack Used 'Headless' Browsers In 150-Hour Siege

Distributed denial-of-service attack employed a browser app toolkit to simulate Web visitors accessing the victim's website

"Headless" browsers pummeled a trading platform's website this past week in a rare form of a distributed denial-of-service (DDoS) attack that lasted for 150 hours.

The attack employed some 180,000 IP addresses -- and as of today continues to rebound in smaller pockets -- according to cloud-based DDoS mitigation service provider Incapsula, which discovered and mitigated the massive attack for its customer.

The company declined to name the targeted organization, only saying it was a trading platform and that the attackers were likely motivated for competitive reasons. "The order of magnitude was significant," says Marc Gaffan, co-founder of Incapsula. "No one has 180,000 IPs at their disposal unless it's an amalgamation of separate botnets they are using interchangeably. This was a sophisticated and thought-out process."

DDoS attacks increasingly have moved up the stack to the application layer, mainly for more targeted purposes, such as disrupting transactions or access to databases. According to new data from Arbor Networks, DDoS attacks, in general, are getting more powerful, but their duration is declining: The average DDoS attack size thus far is 2.64 Gbps for the year, an increase of 78 percent from 2012, and some 87 percent of attacks last less than one hour.

That makes the recent headless browser attack even more unusual, given that its duration was so long. "That's pretty long. Obviously, someone was upset at them," says Marc Eisenbarth, manager of research for Arbor.

[DDoS attack sizes are rising even as the duration of the attacks grows shorter, according to Arbor Networks. See DDoS Attacks Grow Shorter But Pack More Punch.]

The attack also was unusual in that it employed a version of the Phantom JS headless browser toolkit, which is a Web app developer's tool for testing and simulating user browsing of an application. "This was the first time we saw this technology in a DDoS attack," Gaffan says. "It mimics human behavior so effectively that it's a challenge for mitigation services to deal with."

Phantom JS is basically a test tool that uses a bare-bones or "headless" browser -- no buttons, address bar, etc. -- with an API so programmers can test-run and automate their apps. "They can do a load test to websites simulating browser behavior and run JavaScript and accept cookies," for example, Gaffan says.

Arbor's Eisenbarth says he rarely sees Phantom JS being abused the way Incapsula has described this DDoS attack on its customer. "We don't see Phantom JS as much. What we do see are attackers creating hidden [Internet Explorer] browsers that actually are full-function browsers and are even more sophisticated at bypassing detection mechanisms," Eisenbarth says.

The attackers also employed some 861 different variants of the headless browser and were generating some 700 million hits per day on the targeted website, according to Incapsula. "It's really an evasion technique. We try to catch what they are doing, and they try to evade us," Gaffan says. "Our job is to filter out the good guys [legitimate visitors] and let them pass ... the site still needs to operate. And then keep the bad traffic out."

Dan Holden, director of security research at Arbor Networks, says these Layer 7 DDoS attacks take more effort to execute. "There's got to be something financial" motivating the attackers, he says. "These are more common when you've got very focused and targeted attacks."

Incapsula's Gaffan says application-layer DDoS attacks are becoming more popular and often accompany network-layer attacks. "That leaves you scrambling on all fronts," he says. "An application-layer attack is easier to perpetrate because it requires less resources, but you need expertise" to pull it off, he says.

The victim organization's business in the end suffered little impact since Incapsula was able to mitigate the attack, he says. But the DDoS hasn't disappeared yet, either: "It started last week, and to some extent, it's still ongoing," Gaffan says. "There's an ongoing process [by the attackers] of updating and changing" the headless browsers in the attack, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9892
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbit...
CVE-2019-10066
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment i...
CVE-2019-10067
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context...
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...