“ Layer 7 ” DDoS attacks are one of the most sophisticated web attacks that disguise themselves to look like legitimate web traffic, targeting specific areas of a website, which makes them even more difficult to detect.
Just yesterday, cloud-based security firmIncapsuladetected a unique “layer 7” DDoS attack that uses web traffic hijacking techniques. The DDoS attack hit a website with over 20 million GET requests, originating from 22,000 users’ browsers.
What makes this case particularly interesting is the fact that the attack was enabled by a persistent XSS vulnerability on one of the largest and most popular sites in the world – a domain in the Alexa Top 50.
Security firm Incapsula has not yet revealed the name of the vulnerable website for security reasons, but they say it is a high-profile video content provider domain that allows users to have their own profile.
The DDoS attack was triggered by a Persistent XSS (Cross Site Scripting) vulnerability that allowed an attacker to inject malicious JavaScript code into the tag associated with the profile picture, as reported by THN.
The vulnerability on one of the 50 largest websites in the world activates millions of visitors as DDoS Zombies.
So, every time a legitimate visitor reaches any webpage on the domain, the attacker's profile picture will load in the visitor's browser and automatically inject malicious JavaScript which in turn injects a hidden iframe with the address of the attack's command and control (C&C) center. In this way, each visitor's computer is turned into an attacker's computer!
According to Incapsula, the attackers use a DDoS tool with Ajax-script, so they can adapt it to the victim's browser.
Source: secnews.gr
