DDoS Attack Used 'Headless' Browsers In 150-Hour Siege

"Headless" browsers pummeled a trading platform's website this past week in a rare form of a distributed denial-of-service (DDoS) attack that lasted for 150 hours.

The attack employed some 180,000 IP addresses -- and as of today continues to rebound in smaller pockets -- according to cloud-based DDoS mitigation service provider Incapsula, which discovered and mitigated the massive attack for its customer.

The company declined to name the targeted organization, only saying it was a trading platform and that the attackers were likely motivated for competitive reasons. "The order of magnitude was significant," says Marc Gaffan, co-founder of Incapsula. "No one has 180,000 IPs at their disposal unless it's an amalgamation of separate botnets they are using interchangeably. This was a sophisticated and thought-out process."

DDoS attacks increasingly have moved up the stack to the application layer, mainly for more targeted purposes, such as disrupting transactions or access to databases. According to new data from Arbor Networks, DDoS attacks, in general, are getting more powerful, but their duration is declining: The average DDoS attack size thus far is 2.64 Gbps for the year, an increase of 78 percent from 2012, and some 87 percent of attacks last less than one hour.

That makes the recent headless browser attack even more unusual, given that its duration was so long. "That's pretty long. Obviously, someone was upset at them," says Marc Eisenbarth, manager of research for Arbor.

[DDoS attack sizes are rising even as the duration of the attacks grows shorter, according to Arbor Networks. See DDoS Attacks Grow Shorter But Pack More Punch.]

The attack also was unusual in that it employed a version of the Phantom JS headless browser toolkit, which is a Web app developer's tool for testing and simulating user browsing of an application. "This was the first time we saw this technology in a DDoS attack," Gaffan says. "It mimics human behavior so effectively that it's a challenge for mitigation services to deal with."

Phantom JS is basically a test tool that uses a bare-bones or "headless" browser -- no buttons, address bar, etc. -- with an API so programmers can test-run and automate their apps. "They can do a load test to websites simulating browser behavior and run JavaScript and accept cookies," for example, Gaffan says.

Arbor's Eisenbarth says he rarely sees Phantom JS being abused the way Incapsula has described this DDoS attack on its customer. "We don't see Phantom JS as much. What we do see are attackers creating hidden [Internet Explorer] browsers that actually are full-function browsers and are even more sophisticated at bypassing detection mechanisms," Eisenbarth says.

The attackers also employed some 861 different variants of the headless browser and were generating some 700 million hits per day on the targeted website, according to Incapsula. "It's really an evasion technique. We try to catch what they are doing, and they try to evade us," Gaffan says. "Our job is to filter out the good guys [legitimate visitors] and let them pass ... the site still needs to operate. And then keep the bad traffic out."

Dan Holden, director of security research at Arbor Networks, says these Layer 7 DDoS attacks take more effort to execute. "There's got to be something financial" motivating the attackers, he says. "These are more common when you've got very focused and targeted attacks."

Incapsula's Gaffan says application-layer DDoS attacks are becoming more popular and often accompany network-layer attacks. "That leaves you scrambling on all fronts," he says. "An application-layer attack is easier to perpetrate because it requires less resources, but you need expertise" to pull it off, he says.

The victim organization's business in the end suffered little impact since Incapsula was able to mitigate the attack, he says. But the DDoS hasn't disappeared yet, either: "It started last week, and to some extent, it's still ongoing," Gaffan says. "There's an ongoing process [by the attackers] of updating and changing" the headless browsers in the attack, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.