Feeds

Malicious JavaScript flips ad network into rentable botnet

Enslaved machines helplessly press Apache's buttons

Protecting users from Firesheep and other Sidejacking attacks with SSL

Black Hat 2013 Security researchers have shown how hackers can use ad networks to create ephemeral, hard-to-trace botnets that can perform distributed-denial-of-service attacks at the click of a button.

In a presentation at the Black Hat conference in Las Vegas on Wednesday, researchers from WhiteHat Security showed off their technique, which uses iframes in web ads to call a JavaScript file that hammers a site with requests.

The exploit "forces JavaScript to use cross-origin requests to force as many requests as possible out of a single browser or a lot of browsers to a single website," WhiteHat Security's threat research center chief Matt Johansen said.

The company embedded JavaScript code in an advert that they ran on an unnamed ad network. This code pointed to an Amazon Web Services server on which they hosted the core JavaScript file, which they could then modify after the ad was deployed.

WhiteHat confirmed that the ad network did evaluate the code, but seeing nothing overtly malicious, permitted it to go ahead.

"We had kind of benign JavaScript here, but if you started using the evil ideas the code might start to look a bit suspicious," Johansen said. "We didn't dip our toe into the [ad] porn networks."

The researchers' code asked the browser to throttle up to its maximum amount of connections (six in Firefox, for example) and access the website via HTTP. They also demonstrated a workaround that can go above the browsers' permitted number of concurrent connections by using an FTP request format, potentially allowing one browser to flood a site with concurrent connections.

This approach let the researchers deploy an ad that could automatically execute when served on a page and force viewers' browsers to hammer a site of WhiteHat's choice with requests.

"What's the benefit of hacking this way – why not do a traditional DDoS attack?" asked WhiteHat's threat research center manager Matt Johansen, who then answered his own question. "There is no trace of these. The JS gets served up, it goes away. It's very, very easy."

The only real way to trace this back to WhiteHat would be to go to the ad network and get the credit card used to buy the malicious adverts, Johansen said. As Reg readers will know, it's not too difficult for hackers to illicitly and anonymously gain access to credit cards.

In a live demonstration, the researchers showed 256 concurrent connections to a single Apache Web Server, with over a million connections tracked in an hour. The total cost of the ads was lower than the cost of the Amazon instance used to serve the illicit JavaScript, and both only cost tens of dollars.

Next, WhiteHat plans to work with partners to deploy a version of the exploit that explicitly targets a site protected by a DDoS-protection service. They also plan to try and use the technique to run distributed MD5 hash cracking via a software tool such as Ravan. Previously, the same researchers have cracked open Google's Chrome OS.

Much to the dismay of this ad-funded publication, the researchers plugged the use of ad blockers as one of the only easy ways to remediate this problem. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.