DDoS Attack Used Headless Browsers In 150-Hour Siege

Distributed denial-of-service attack employed a browser app toolkit to simulate Web visitors accessing the victims website

Headless browsers pummeled a trading platforms website this past week in a rare form of a distributed denial-of-service (DDoS) attack that lasted for 150 hours.
The attack employed some 180,000 IP addresses -- and as of today continues to rebound in smaller pockets -- according to cloud-based DDoS mitigation service provider Incapsula, which discovered and mitigated the massive attack for its customer.
The company declined to name the targeted organization, only saying it was a trading platform and that the attackers were likely motivated for competitive reasons. The order of magnitude was significant, says Marc Gaffan, co-founder of Incapsula. No one has 180,000 IPs at their disposal unless its an amalgamation of separate botnets they are using interchangeably. This was a sophisticated and thought-out process.
DDoS attacks increasingly have moved up the stack to the application layer, mainly for more targeted purposes, such as disrupting transactions or access to databases. According to new data from Arbor Networks, DDoS attacks, in general, are getting more powerful, but their duration is declining: The average DDoS attack size thus far is 2.64 Gbps for the year, an increase of 78 percent from 2012, and some 87 percent of attacks last less than one hour.
That makes the recent headless browser attack even more unusual, given that its duration was so long. Thats pretty long. Obviously, someone was upset at them, says Marc Eisenbarth, manager of research for Arbor.
[DDoS attack sizes are rising even as the duration of the attacks grows shorter, according to Arbor Networks. See
DDoS Attacks Grow Shorter But Pack More Punch
.]
The attack also was unusual in that it employed a version of the Phantom JS headless browser toolkit, which is a Web app developers tool for testing and simulating user browsing of an application. This was the first time we saw this technology in a DDoS attack, Gaffan says. It mimics human behavior so effectively that its a challenge for mitigation services to deal with.
Phantom JS is basically a test tool that uses a bare-bones or headless browser -- no buttons, address bar, etc. -- with an API so programmers can test-run and automate their apps. They can do a load test to websites simulating browser behavior and run JavaScript and accept cookies, for example, Gaffan says.
Arbors Eisenbarth says he rarely sees Phantom JS being abused the way Incapsula has described this DDoS attack on its customer. We dont see Phantom JS as much. What we do see are attackers creating hidden [Internet Explorer] browsers that actually are full-function browsers and are even more sophisticated at bypassing detection mechanisms, Eisenbarth says.
The attackers also employed some 861 different variants of the headless browser and were generating some 700 million hits per day on the targeted website, according to Incapsula. Its really an evasion technique. We try to catch what they are doing, and they try to evade us, Gaffan says. Our job is to filter out the good guys [legitimate visitors] and let them pass ... the site still needs to operate. And then keep the bad traffic out.
Dan Holden, director of security research at Arbor Networks, says these Layer 7 DDoS attacks take more effort to execute. Theres got to be something financial motivating the attackers, he says. These are more common when youve got very focused and targeted attacks.
Incapsulas Gaffan says application-layer DDoS attacks are becoming more popular and often accompany network-layer attacks. That leaves you scrambling on all fronts, he says. An application-layer attack is easier to perpetrate because it requires less resources, but you need expertise to pull it off, he says.
The victim organizations business in the end suffered little impact since Incapsula was able to mitigate the attack, he says. But the DDoS hasnt disappeared yet, either: It started last week, and to some extent, its still ongoing, Gaffan says. Theres an ongoing process [by the attackers] of updating and changing the headless browsers in the attack, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
DDoS Attack Used Headless Browsers In 150-Hour Siege