Demo Facebook Application Creates DoS Botnet

Via Zero Day Blog (ZDNet) -

Do you know what that innocent-looking Facebook app is really doing?

Researchers at the Institute of Computer Science (ICS) have created a proof-of-concept Facebook application capable of covertly herding users of the popular social network into a powerful — and malicious — botnet.

The demo application, called Photo of the Day, delivers a different image from National Geographic everyday but, behind the scenes, special code embedded into the application creates a botnet of Facebook users launching denial-of-service attacks.

In a research paper (.pdf) to be presented at this year’s Information Security Conference, the research group provided technical details of its Facebot:

• [W]e have placed special code in the application’s source code, so that every time a user views the photo, HTTP requests are generated towards a victim host. More precisely, the application embeds four hidden frames with inline images hosted at the victim. Each time the user clicks inside the application, the inline images are fetched from the victim, causing the victim to serve a request of 600 KBytes, but the user is not aware of that fact (the images are never displayed).

While the proof-of-concept app was used to demo a denial-of-service attack scenario, the group issued a terse warning:

• [An] adversary could employ more sophisticated techniques and create a JavaScript snippet, which continuously requests documents from a victim host overtime. In this way the attack may be significantly amplified.

Interestingly, the researchers made no effort to advertise/distribute its Facebook application but was able to attract more than 1,000 users in the first few days. With a bit of effort to manipulate the viral nature of app distribution on Facebook (the inherent trust of the social network model), a malicious Facebot with tens of thousands of users can do some serious damage.

“We have shown that the victim of a FaceBot attack may be subject to an attack that will cause it to serve data of the magnitude of GigaBytes per day,” the group warned.