David Baxter PhD
Late Founder
Demo Facebook app creates DoS botnet
by Ryan Naraine
September 5th, 2008
Do you know what that innocent-looking Facebook app is really doing?
Researchers at the Institute of Computer Science (ICS) have created a proof-of-concept Facebook application capable of covertly herding users of the popular social network into a powerful ? and malicious ? botnet.
The demo application, called Photo of the Day, delivers a different image from National Geographic everyday but, behind the scenes, special code embedded into the application creates a botnet of Facebook users launching denial-of-service attacks.
In a research paper
to be presented at this year?s Information Security Conference, the research group provided technical details of its Facebot:
While the proof-of-concept app was used to demo a denial-of-service attack scenario, the group issued a terse warning:
?We have shown that the victim of a FaceBot attack may be subject to an attack that will cause it to serve data of the magnitude of GigaBytes per day,? the group warned.
In the paper, the researchers called on Facebook and other social networks to rethink the way APIs are designed and developed:
by Ryan Naraine
September 5th, 2008
Do you know what that innocent-looking Facebook app is really doing?
Researchers at the Institute of Computer Science (ICS) have created a proof-of-concept Facebook application capable of covertly herding users of the popular social network into a powerful ? and malicious ? botnet.
The demo application, called Photo of the Day, delivers a different image from National Geographic everyday but, behind the scenes, special code embedded into the application creates a botnet of Facebook users launching denial-of-service attacks.
In a research paper
to be presented at this year?s Information Security Conference, the research group provided technical details of its Facebot:[W]e have placed special code in the application?s source code, so that every time a user views the photo, HTTP requests are generated towards a victim host. More precisely, the application embeds four hidden frames with inline images hosted at the victim. Each time the user clicks inside the application, the inline images are fetched from the victim, causing the victim to serve a request of 600 KBytes, but the user is not aware of that fact (the images are never displayed).
(See Facebook refuses to fix obvious security flaw.)While the proof-of-concept app was used to demo a denial-of-service attack scenario, the group issued a terse warning:
[An] adversary could employ more sophisticated techniques and create a JavaScript snippet, which continuously requests documents from a victim host overtime. In this way the attack may be significantly amplified.
Interestingly, the researchers made no effort to advertise/distribute its Facebook application but was able to attract more than 1,000 users in the first few days. With a bit of effort to manipulate the viral nature of app distribution on Facebook (the inherent trust of the social network model), a malicious Facebot with tens of thousands of users can do some serious damage.
(See Web worms squirm through Facebook, MySpace.)Interestingly, the researchers made no effort to advertise/distribute its Facebook application but was able to attract more than 1,000 users in the first few days. With a bit of effort to manipulate the viral nature of app distribution on Facebook (the inherent trust of the social network model), a malicious Facebot with tens of thousands of users can do some serious damage.
?We have shown that the victim of a FaceBot attack may be subject to an attack that will cause it to serve data of the magnitude of GigaBytes per day,? the group warned.
In the paper, the researchers called on Facebook and other social networks to rethink the way APIs are designed and developed:
Providers of social networks should be careful when designing their platform and APIs in order to have low interactions between the social utilities they operate and the rest of the Internet. More precisely, social network providers should be careful with the use of client side technologies, like JavaScript, etc. A social network operator should provide developers with a strict API, which is capable of giving access to resources only related to the system. Also, every application should run in an isolated environment imposing constraints to prevent the application from interacting with other Internet hosts, which are not participants of the social network. Finally, operators of social networks should invest resources in verifying the applications they host.
