New DDoS attack uses smartphone browsers to flood site with 4.5bn requests

Researchers suspect a mobile advertising network has been used to point hundreds of thousands of smartphone browsers at a website with the aim of knocking it offline.

According to distributed denial-of-service protection service CloudFlare, one customer's site recently came under fire from 4.5 billion page requests during a few hours, mostly from smartphone browsers on Chinese IP addresses.

As CloudFlare's Marek Majkowski notes, browser-based 'Layer 7' flood attacks have been viewed as a theoretical threat for several years, but haven't become a reality due to difficulties in efficiently distributing malicious JavaScript to force a large number of browsers to make HTTP requests to a targeted site.

Security researchers have previously suggested web ads as an efficient way to distribute malicious JavaScript.

Analysing the log files, Majkowski found the smartphone browser attack peaked at over 275,000 HTTP requests per second, with 80 percent coming from mobile devices and 98 percent from a Chinese IP address. The logs also reveal mobile versions of Safari, Chrome, Xiaomi's MIUI browser, and Tencent's QQBrowser.

"Strings like 'iThunder' might indicate the request came from a mobile app. Others like 'MetaSr', 'F1Browser', 'QQBrowser', '2345Explorer', and 'UCBrowser' point towards browsers or browser apps popular in China," Majkowski said.

Majkowski speculates that the attack was made possible by an ad network, and believes the reason so many mobile browsers visited the attack page hosting the malicious JavaScript was due to ads shown in iframes, either in mobile apps or mobile browsers.

Here's how the attack works: when a user opens an app or browses the web, they are served an iframe with an ad whose content was requested from an ad network. The ad network then forwards the request to a third-party that successfully bids for that inventory and then forwards the user to an attack page.

"The user was served an attack page containing a malicious JavaScript which launched a flood of XHR requests against CloudFlare servers," explained Majkowski.

The attack site itself hosting the malicious JavaScript included instructions to launch an XHR in a loop.

Read more

• Kaspersky reveals 'almost invisible' hacking attack on its systems
• Premera Blue Cross hit by "sophisticated" hack, 11M affected
• Unpatched Android Lollipop devices open to lockscreen bypass bug