Million Browser Botnet
Talkat AppSec California 2014 · on Monday, 2014-01-27· at 14:45· Track 1, Annenberg Community Beach House, East Pacific Coast Highway·
summary
Claim: buying ad impressions and cheap browser time runs arbitrary JavaScript and scales to vast botnets. Code uses plain HTML5/JavaScript (image tags, web workers, Ravon for hash cracking), ad networks and a browser‑rental service, and an FTP connection bypass that circumvents Firefox limits. Economics: roughly 50¢ per thousand browsers so a million browser botnet costs about $500. Experiments pin an Apache instance (millions of requests, ~0.25–0.5 TB in a day) and trigger Akamai defenses without exploiting zero‑days — it works.
AI-written summary · about
chapters (39)
- 0:00Intro
- 1:03Matts Background
- 2:27How the Web Works
- 3:30Browser Bots
- 5:40More Aggressive
- 6:43Login Detection
- 7:39Like Button
- 8:42Internet Hacking
- 9:13Cross Site Scripting
- 9:24iframes
- 10:27Raavan
- 11:20Application Level Distributed Denial of Service
- 12:22Browser Scope
- 13:02Firefox
- 17:32Conclusion
- 18:10Traditional Methods
- 19:29Advertising Ecosystem
- 20:42Advertising Network
- 21:51Kobi
- 22:25Browser Renting
- 23:56The Economics
- 25:05The Ad Network
- 31:49Demo
- 33:01PhantomJS
- 34:31Browserminute
- 34:55Ad Network
- 35:08Connection Flood
- 35:36Ass Badge
- 35:49Traffic
- 36:05Half a gig
- 36:23Total hits
- 37:11I was still counting up
- 37:31I had bought 10000
- 38:59We had tacit permission to Akamai
- 40:47Deploying the FTP Bypass
- 42:46Turning it off
- 44:11Why attack this way
- 45:38OpenX vulnerability
- 46:21Web security challenges
related talks
30mTaming the World’s Largest Trojan Horse
25mHow to Pull Off a Near Undetectable DDoS Attack...
31mStrategies for Identifying and Mitigating Bot Threats
29mStandard Classification: Good Bot, Bad Bot: Characterizing Automated Brows...
48mHow to Thwart Malicious Automation and Kick Bot Butt for $0
52mBreaking Fraud and Bot Detection Solutions
54mModern Malvertising and Malware web-based exploit campaigns
40mHostile JavaScript: Attacking and Defending the Browser