Universe HaCker: Vulnerability

<div class="td-post-featured-image" style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Open Sans'; font-size: 17px; line-height: 31px; position: relative;"><a class="td-modal-image" data-caption="" href="https://www.latesthackingnews.com/wp-content/uploads/2014/04/layer-7-ddos-attack-xss-flaw-scheme.png" style="background-color: transparent; box-sizing: border-box; color: #215529; text-decoration: none;"><img alt="" class="entry-thumb" height="554" itemprop="image" src="https://www.latesthackingnews.com/wp-content/uploads/2014/04/layer-7-ddos-attack-xss-flaw-scheme.png" style="border: 0px; box-sizing: border-box; display: block; height: auto; margin-bottom: 26px; max-width: 100%; width: auto;" title="layer-7-ddos-attack-xss-flaw-scheme" width="606" /></a></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Open Sans'; font-size: 17px; line-height: 31px; margin-bottom: 26px;"><br style="box-sizing: border-box;" /></div><div style="background-color: white; box-sizing: border-box; line-height: 31px; margin-bottom: 26px;"><span style="font-family: Arial, Helvetica, sans-serif;">persistent cross-site scripting (XSS) vulnerability in a popular site that hosts video content enabled an attacker to carry out a distributed denial-of-service (DDOS) attack against a different site, according to California-based website security company Incapsula, which helped mitigate the Thursday attack.</span></div><div style="background-color: white; box-sizing: border-box; line-height: 31px; margin-bottom: 26px;"><span style="font-family: Arial, Helvetica, sans-serif;">The video content website is one of the largest and most popular and sits in the Alexa top 50, according to a Thursday post by Ronen Atias, a security researcher with Incapsula, who explained that the name of the popular video site and the name of the DDoS target could not be revealed.</span></div><div style="background-color: white; box-sizing: border-box; line-height: 31px; margin-bottom: 26px;"><span style="font-family: Arial, Helvetica, sans-serif;">Specific details of the vulnerability also could not be revealed, at least not until it is fixed, but Atias did explain how the attack worked. He said it began with the attacker using the persistent XSS vulnerability to inject a JavaScript payload into the <img> tag for a member’s profile picture on the video website.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Open Sans'; font-size: 17px; line-height: 31px; margin-bottom: 26px;"><br /></div><blockquote style="background: rgb(249, 249, 249); border-left-style: none; box-sizing: border-box; color: #222222; font-family: 'Open Sans'; font-size: 17px; line-height: 31px; margin: 40px 32px 38px; padding: 0px; position: relative; quotes: "“" "”" "‘" "’";"><div style="box-sizing: border-box; color: #215529; display: inline; font-family: Roboto, sans-serif; font-size: 32px; font-style: italic; line-height: 40px; margin-bottom: 26px; text-align: center; text-transform: uppercase;">“WE USED INCAPSULA’S TECHNOLOGY TO IDENTIFY THE MALICIOUS REQUESTS, INTERCEPT THEM AND RE-ROUTE THEM TO ANOTHER LOCATION WHICH HELD A CUSTOM MADE SCRIPT, [WHICH] TRACED THE REQUEST BACK TO THE DDOS TOOL AND TO THE ABUSED SITE,” ZEIFMAN SAID.</div><div style="box-sizing: border-box; float: none; margin: 10px 0px; text-align: center;"><center style="box-sizing: border-box;"><div style="box-sizing: border-box; color: #215529; display: inline; font-family: Roboto, sans-serif; font-size: 32px; font-style: italic; line-height: 40px; margin-bottom: 26px; text-transform: uppercase;"></div></center></div></blockquote><br /><blockquote style="background: rgb(249, 249, 249); border-left-style: none; box-sizing: border-box; color: #222222; font-family: 'Open Sans'; font-size: 17px; line-height: 31px; margin: 40px 32px 38px; padding: 0px; position: relative; quotes: "“" "”" "‘" "’";"><div style="box-sizing: border-box; float: none; margin: 10px 0px; text-align: center;"><center style="box-sizing: border-box;"><div style="box-sizing: border-box; color: #215529; display: inline; font-family: Roboto, sans-serif; font-size: 32px; font-style: italic; line-height: 40px; margin-bottom: 26px; text-transform: uppercase;">ZEIFMAN SAID HE DOES NOT THINK A DDOS LIKE THIS HAS EVER BEEN CARRIED OUT BEFORE – AT LEAST NOT THROUGH SUCH A PROMINENT WEBSITE – AND ADDED THAT WHAT HE WITNESSED TAKING PLACE APPEARED TO BE MORE OF A TEST RUN, TO SEE IF THIS TYPE OF ATTACK CAN BE EFFECTIVE.</div> <div style="box-sizing: border-box; color: #215529; display: inline; font-family: Roboto, sans-serif; font-size: 32px; font-style: italic; line-height: 40px; margin-bottom: 26px; text-transform: uppercase;">“THE WEBSITE IN QUESTION NEEDS TO DIRECTLY ADDRESS THIS VULNERABILITY; IT IS A WEAK SPOT UNIQUE TO THEIR WEBSITE,” ZEIFMAN SAID. “THE TRICKY PART IS KNOWING THAT SUCH A WEAK SPOT EVEN EXISTS.”</div></center></div></blockquote><div style="background-color: white; box-sizing: border-box; line-height: 31px; margin-bottom: 26px;"><span style="font-family: Arial, Helvetica, sans-serif;">Next, the attacker chose to post in the comments section of the most popular videos. This caused the injected image to be hosted on those pages, so whenever the videos were viewed, the JavaScript activated, GET requests were sent to target sites, and, ultimately, the DDoS was carried out with the unknowing aid of viewers.</span></div><div style="background-color: white; box-sizing: border-box; line-height: 31px; margin-bottom: 26px;"><span style="font-family: Arial, Helvetica, sans-serif;">In the end, Incapsula’s client was hit by more than 20 million GET requests stemming from more than 22,000 viewers, according to the post. In a Friday email correspondence, Igal Zeifman, product evangelist with Incapsula, explained to SCMagazine.com how the company picked up on the attack.</span></div>

Vulnerability XSS vulnerability in popular video site enables unique DDoS attack

persistent cross-site scripting (XSS) vulnerability in a popular site that hosts video content enabled an attacker to carry out a distribute...

Click here for more posts »

Universe HaCker

VPnium Vpn Crack 2017

XSS vulnerability in popular video site enables unique DDoS attack

Popular Posts

Blog Archive