Creating a botnet to carry out Distributed Denial of Service attacks (DDoS), is simpler than many people realise. Recently, Incapsula reported an attack they uncovered that involved a profile image associated with comments on a webpage in order to get the user’s browser to carry out a DDoS attack on a target site.
A DDoS attack requires a large number of GET requests sent over a short period. This attack reported by Incapsula, sent one GET request to the target site every second. The infected images were placed on a video download site – if unsuspecting users viewed a video for say 30 minutes – every second during that period a GET message was sent to the target site. By placing his infected image on a number of pages hosting different popular videos, the attacker caused 22,000 users to issue a total of 20 million GET requests.
Jeremiah Grossman and Matt Johansen from WhiteHat Security have shown that by bypassing the connection limits of the browser, it is possible for an attacker to scale up and increase the number of simultaneous connections and send out a higher rate of GET requests. They believe that it is possible to send up to 10,000 GET requests per minute from each browser that has been compromised.
These researchers have also shown that this attack can be easily launched through online advertisements. They calculate that it would cost around $500 advertising spend to infect and create a botnet of 1 million browsers. With each browser sending 10,000 GET requests per minute, it would be a most formidable DDoS attack.
In addition to using the botnet to launch a DDoS attack, it is also possible to use it for other purposes such as password hash cracking.
There is no browser-side patch for this attack. Browsers are designed to execute code in this manner. The use of an ad blocker will prevent your browser unwittingly joining a botnet through advertisements.
The ease with which a botnet such as described can be created, would indicate that we can expect this method to be used more often in the future in DDoS attacks.