Facebook: Your new botnet for DDoS attacks!

[Renegade]

Want to take down some sites? Get a Facebook account and access to their almost unlimited bandwidth.

http://chr13.com/2014/04/20/using-facebook-notes-to-ddos-any-website/

Steps to re-create the bug as reported to Facebook Bug Bounty on March 03, 2014.
Step 1. Create a list of unique img tags as one tag is crawled only once

Code: (html4strict)

        <img src=http://targetname/file?r=1></img>
        <img src=http://targetname/file?r=1></img>
        ..
        <img src=http://targetname/file?r=1000></img>

Step 2. Use m.facebook.com to create the notes. It silently truncates the notes to a fixed length.

Step 3. Create several notes from the same user or different user. Each note is now responsible for 1000+ http request.

Step 4. View all the notes at the same time. The target server is observed to have massive http get flood. Thousands of get request are sent to a single server in a couple of seconds. Total number of facebook servers accessing in parallel is 100+.

It won't get fixed. More on that at the link.

Have fun~!

[Stoic Joker]

Now all we need is a new meme for FaceDoS'ing

[wraith808]

Another link: http://thehackernews.com/2014/04/vulnerability-allows-anyone-to-ddos.html

Unfortunately, Facebook has no plans to fix this critical vulnerability, “In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality,” Facebook replied to the researcher.

What the what?

[Innuendo]

It won't get fixed. More on that at the link.

Oh, if behavior like that persists, it'll get fixed. Just not the way Facebook wants. Businesses and ISPs will just configure their networks to deny all Facebook-owned IP addresses from accessing their networks.

I'm sure there are sysadmins who fight off the temptation of doing it every day. All they need is an excuse.

Would I want to see that happen?

Hmm...a little bit. Yeah.

[app103]

You did notice how he mentioned that Google has a similar issue, and that when you combine them, the attack is much worse?

Google also seems to not want to fix it.

http://chr13.com/2014/03/10/using-google-to-ddos-any-website/