A new type of distributed denial-of-service (DDoS) attack is abusing a common HTML5 attribute to overwhelm targeted victims.
Security firm Imperva reported on April 11 that it has discovered a campaign where hackers abused the tag ping HTML5 attribute in a DDoS attack that generated 70 million requests in four hours. The ping attribute is intended to be used by websites as a mechanism to notify a website if a user follows a given link on a page. Typically, a ping is a single action, but Imperva discovered that hackers have found a way to amplify the ping into a more persistent data flow, triggering the DDoS attack.
How the Ping Attack Overwhelms a Server
- Targeting the web server using high RPS, the server will be forced into processing the DDoS attack and not handle legitimate traffic.
- Targeting the web application by finding an injection point will cause a high resource consumption. For example, the login form will cause a query to the database.
Defending Against Ping DDoS
There are several things that organizations can do to minimize the risk of a Ping DDoS attack.