How to Pull Off a Near Undetectable DDoS Attack...
summary
Claim: attackers buy cheap ad placements and push obfuscated JavaScript into real browsers to mount near‑undetectable layer‑7 DDoS that looks like normal users. Tools and vectors include hidden iframe rendering, webworker‑based flood and fetch/XHR or hidden tab methods distributed via secondary ad networks, leaky S3/npm dependencies or redirects to proxy domains. Observed scale: 300,000 client‑side attacks in Q1; modest math shows 10,000 infected laptops at 100 req/s easily yields 1,000,000 rps and defeats IP/fingerprint defenses. CSP/SRI, strict auditing and logging help; CAPTCHAs often fail.
AI-written summary · about
chapters (9)
- 0:00Introduction and welcome
- 1:22What is client side security
- 4:32DDoS attack origins and detection
- 8:02Designing undetectable DDoS attacks
- 11:32Real-world attack methods
- 13:59Why these attacks bypass defenses
- 15:23Protecting against client side DDoS
- 18:08Final thoughts on client side risks
- 19:32Q&A session
related talks
45mAnatomy of a DDoS
52mInvestigating DDOS - Architecture Actors and Attribution
37mAnatomy of a DDoS
41mAre DDoS attacks a threat to the decentralised internet?
45mBarbarians at the Gate(way)
12mSpeed, scale & stealth: Securing against ATO events
40mThe new reality of DDOS
42mWarding against the Dark Arts: Crafting a Defense Strategy against Botnet DDoS