Yesterday we mitigated a unique application layer DDoS attack against one of our clients. The attack was carried out using traffic hijacking techniques, which flooded our client with over 20 million GET requests originating from the browsers of over 22,000 Internet users - all turned into unwilling accomplices by the offender.
What makes this case especially interesting is the fact that the attack was enabled by a vulnerability in one of the world’s largest and most popular sites - one of the domains on Alexa’s “Top 50” list.
We can’t disclose the domain name in question at this time, as our team is now working to resolve the breach. However, we will provide further details, once the vulnerability is fixed.
Having said that, we can already describe the method used by the attackers, in the hopes that it will help prevent similar abuse of other websites.
Persistent XSS Enables Large-Scale DDoS Attack
Obviously one request per second is not a lot. However, when dealing with video content of 10, 20 and 30 minutes in length, and with thousands of views every minute, the attack can quickly become very large and extremely dangerous. Knowing this, the offender strategically posted comments on popular videos, effectively created a self-sustaining botnet comprising tens of thousands of hijacked browsers, operated by unsuspecting human visitors who were only there to watch a few funny cat videos.
Intercepting the Attack
We were then able to replicate the Persistent XSS responsible for the attack. Once we had all of this information in hand, we quickly reached out to the site support team, offering our help in fixing the issue.
It should be noted that yesterday the original DDoS tool on the attacker’s C&C domain was replaced with a much more robust version. This leads us to believe that what we saw yesterday was a sort of POC test run. The current code is not only much more sophisticated, but it is also built for keeping track of the attack, for what seems like billing purposes. From the looks of it, someone is now using this Alexa Top 50 website to set up a chain of botnets for hire.
Update: April 24
No, it wasn’t YouTube
The disclosure of this vulnerability received extensive media coverage, which was accompanied by numerous attempts to guess the website’s identity. By far, the most popular assumption was that this story is about YouTube. While we wanted to debunk that rumor, we couldn’t allow ourselves to be drawn into a “twenty questions” game, which would inevitably provide additional clues to the vulnerable website’s true identity.
Now, with the vulnerability patched, we can divulge that the site in question is Sohu.com (Chinese for “Search-fox") - China’s 8th largest website and currently the 27th most visited website in the world.
While being relatively unfamiliar to Western audiences, Sohu is a local and global powerhouse. This rapidly growing $2.5 billion organization provides a variety of search and content solutions, including Sohu.TV – the video streaming service that enabled the DDoS attack to occur.
Once we uncovered the source of the browser-based DDoS attack and replicated persistent XSS vulnerability that allowed it to occur we immediately went on to share our findings with Sohu security team. With this information in hand Sohu team could quickly evaluate the problem and respond with a rapid patch which fixed the security hole, rendering this browser-based botnet completely useless.
Co-Authored by: Ofer Gayer - Incapsula's Security Researcher