One of World’s Largest Websites Hacked

[Venustus]

Cloud-based security service provider ‘Incapsula‘ detected a unique application layer DDoS attack, carried out using traffic hijacking techniques. DDoS attack flooded one of their client with over 20 million GET requests, originating from browsers of over 22,000 Internet users.

What makes this case especially interesting is the fact that the attack was enabled by persistent XSS vulnerability in one of the world’s largest and most popular site – one of the domains on Alexa’s “Top 50” list.

XSS vulnerability to Large-Scale DDoS Attack
Incapsula has not disclosed the name of vulnerable website for security reasons, but mentioned it as a high profile video content provider website, allows its users to sign-up and sign-in with their own profiles.

The DDoS attack was enabled by a Persistent XSS (Cross site scripting) vulnerability that allowed the attacker to inject a malicious JavaScript code into the tag associated with the profile image.

More

 

[Mateotis]

Wow, now that's one heck of a vulnerability!

 

[Venustus]

Wow, now that's one heck of a vulnerability!

Indeed,with 20 million "GET requests"!!

 

[Ink]

The "video site" should be patched now. Things could get interesting now.

Researchers also mentioned that attackers behind recent DDoS attack have upgraded their DDoS tool to a much more robust version. “This leads us to believe that what we saw yesterday was a sort of POC test run. ” Incapsula quickly reached out to the vulnerable video website support team to patch the flaw.​

 

[Venustus]

The "video site" should be patched now. Things could get interesting now.

Researchers also mentioned that attackers behind recent DDoS attack have upgraded their DDoS tool to a much more robust version. “This leads us to believe that what we saw yesterday was a sort of POC test run. ” Incapsula quickly reached out to the vulnerable video website support team to patch the flaw.​

Huracan, could you please elaborate on which website was involved!?

 

[Ink]

My guess is no better than anyone else.

http://www.alexa.com/topsites

 

[Oxygen]

Ofc everyone will target top sites.

 

[Deleted member 178]

2 videos websites only and one of them is a porn one...so guessed who is the other

are you watching Mycylinder?