More and more websites are doing the Harlem Shake, as attackers exploit cross-site scripting (XSS) vulnerabilities that make pages dance and sway to this familiar rhythm that is breaking the internet!
The vulnerabilities exist in the DNS text record – not the protocol – and allow internet trolls to turn boring websites like Who.is into non-stop partying sites.
Regarding the "attack" on Who.is, NCC Group Asia Pacific CEO Wade Alcorn said:
"The DNS protocol is not vulnerable in this case – the attack is the result of a vulnerability in the web application and is related to how it parses the results from the DNS query.".
"A firewall for the web application would not have prevented the attack. This scenario highlights the need for secure coding practices and that all inputs to an application should be protected against attackers," he added.
https://www.youtube.com/watch?v=rJta42I1YQA
