Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/17/2013
01:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DDoS Attack Used 'Headless' Browsers In 150-Hour Siege

Distributed denial-of-service attack employed a browser app toolkit to simulate Web visitors accessing the victim's website

"Headless" browsers pummeled a trading platform's website this past week in a rare form of a distributed denial-of-service (DDoS) attack that lasted for 150 hours.

The attack employed some 180,000 IP addresses -- and as of today continues to rebound in smaller pockets -- according to cloud-based DDoS mitigation service provider Incapsula, which discovered and mitigated the massive attack for its customer.

The company declined to name the targeted organization, only saying it was a trading platform and that the attackers were likely motivated for competitive reasons. "The order of magnitude was significant," says Marc Gaffan, co-founder of Incapsula. "No one has 180,000 IPs at their disposal unless it's an amalgamation of separate botnets they are using interchangeably. This was a sophisticated and thought-out process."

DDoS attacks increasingly have moved up the stack to the application layer, mainly for more targeted purposes, such as disrupting transactions or access to databases. According to new data from Arbor Networks, DDoS attacks, in general, are getting more powerful, but their duration is declining: The average DDoS attack size thus far is 2.64 Gbps for the year, an increase of 78 percent from 2012, and some 87 percent of attacks last less than one hour.

That makes the recent headless browser attack even more unusual, given that its duration was so long. "That's pretty long. Obviously, someone was upset at them," says Marc Eisenbarth, manager of research for Arbor.

[DDoS attack sizes are rising even as the duration of the attacks grows shorter, according to Arbor Networks. See DDoS Attacks Grow Shorter But Pack More Punch.]

The attack also was unusual in that it employed a version of the Phantom JS headless browser toolkit, which is a Web app developer's tool for testing and simulating user browsing of an application. "This was the first time we saw this technology in a DDoS attack," Gaffan says. "It mimics human behavior so effectively that it's a challenge for mitigation services to deal with."

Phantom JS is basically a test tool that uses a bare-bones or "headless" browser -- no buttons, address bar, etc. -- with an API so programmers can test-run and automate their apps. "They can do a load test to websites simulating browser behavior and run JavaScript and accept cookies," for example, Gaffan says.

Arbor's Eisenbarth says he rarely sees Phantom JS being abused the way Incapsula has described this DDoS attack on its customer. "We don't see Phantom JS as much. What we do see are attackers creating hidden [Internet Explorer] browsers that actually are full-function browsers and are even more sophisticated at bypassing detection mechanisms," Eisenbarth says.

The attackers also employed some 861 different variants of the headless browser and were generating some 700 million hits per day on the targeted website, according to Incapsula. "It's really an evasion technique. We try to catch what they are doing, and they try to evade us," Gaffan says. "Our job is to filter out the good guys [legitimate visitors] and let them pass ... the site still needs to operate. And then keep the bad traffic out."

Dan Holden, director of security research at Arbor Networks, says these Layer 7 DDoS attacks take more effort to execute. "There's got to be something financial" motivating the attackers, he says. "These are more common when you've got very focused and targeted attacks."

Incapsula's Gaffan says application-layer DDoS attacks are becoming more popular and often accompany network-layer attacks. "That leaves you scrambling on all fronts," he says. "An application-layer attack is easier to perpetrate because it requires less resources, but you need expertise" to pull it off, he says.

The victim organization's business in the end suffered little impact since Incapsula was able to mitigate the attack, he says. But the DDoS hasn't disappeared yet, either: "It started last week, and to some extent, it's still ongoing," Gaffan says. "There's an ongoing process [by the attackers] of updating and changing" the headless browsers in the attack, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14345
PUBLISHED: 2019-11-15
TemaTres 3.0 allows remote unprivileged users to create an administrator account
CVE-2019-14343
PUBLISHED: 2019-11-15
TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
CVE-2019-14869
PUBLISHED: 2019-11-15
A flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could esc...
CVE-2019-18987
PUBLISHED: 2019-11-15
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public, its previous versions can be exposed, thus potentially disclosing private or sensitive information within the filter's definition.
CVE-2019-18986
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.