1

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/Facebook to do this?

Like, every time I slide the screen, a POST/GET request goes to some target website/application that will be overwhelmed by the traffic? Are pirate sites a part of this?

Improve this question
5
  • Of course, it is possible. There is no recorded instance of this, though.
    – schroeder ♦
    Jun 10, 2021 at 15:50
  • @schroeder , I mean like governments can theoretically wield these apps to do these things right?
    – Vishwa Mithra
    Jun 10, 2021 at 15:54
  • Huh? Why would a government use a popular service to DDoS something? They have much, much better ways to accomplish what they want.
    – schroeder ♦
    Jun 10, 2021 at 15:55
  • @schroeder China did it
    – nobody
    Jun 10, 2021 at 15:56
  • 1
    @schroeder so as to make it appear like it is done by some local hacking group? especially if it is also popular in other nations like facebook and Tiktok. I mean, this can be done with electrical grids and stuff etc. which all are today, controlled through the net.
    – Vishwa Mithra
    Jun 10, 2021 at 16:03

2 Answers 2

Reset to default
3

"big institutions" have very strict policy, multiple stage development chain, dedicated quality team and canary testing implemented. It's not that easy task for single rogue developer to insert anything nasty. Theoretically possible, but not probable.

Moreover, if the attacker is able to insert a DDOS payload, how about some spyware, backdoor, bitcoin miner or alike? Considering the sizeable reputation (and financial) impact of such a fiasco you bet they will try to avoid that at all costs.

Of course if there is some vulnerability in the site's code, or using a MitM attack (see the other answer) it might be feasible without an insider.

EDIT: While it's certainly possible to insert malicious code into some "popular package" which the site uses, it's not an easy task. Normally, big players are not using huge number of random libraries like common developers do. Even if they are popular. Not because it could be dangerous, but because they need control and reliable supply chain. Most "popular libraries" simply won't qualify. The biggest tech firms often design their own solution and open source it instead. If they are using some existing codebase they quite often delegate developers into the community in order to maintain control over the project and get the required expertise.

It's unreasonable to think one can simply insert an exploit into a popular FLOSS codebase and big players will include it blindly. Even if the community fail to catch the exploit (which not impossible but pretty improbable in case of a popular project) the institution's rigorous testing protocol might detect the problem in time. Even if the QA team fails to catch the problem, it might be trivial during canary testing which mitigates the scale of the problem.

If the DDOS code contains fixed targets, remote control or is scheduled, it's pretty much trivial to spot. It would be very-very hard to push it through multiple layers of quality control.

Improve this answer
5
  • I mean, it could simply be inserted into a very popular javascript package, which the website uses. Or any hidden abstracted function right?
    – Vishwa Mithra
    Jun 10, 2021 at 18:06
  • @VishwaMithra: answer updated. This scenario is my field of research, if you know exact cases I'm very interested!
    – goteguru
    Jun 10, 2021 at 23:56
  • here is the thing, what if it is intentional on the institution's part? either because they want to attack a rivaling company or another nation because the government wants to?
    – Vishwa Mithra
    Jun 11, 2021 at 8:40
  • It can be easily hidden through the use of packages which will indeed be developed by themselves or by others. And the DDOS attack requires only a post or get request. Even then, it will seem like they got a ton of traffic but it will go no where as the intention itself is to DDOS. I believe this a very very strong reason to not allow foreign technological companies which could be influenced by their governments.
    – Vishwa Mithra
    Jun 11, 2021 at 8:43
  • @VishwaMithra if it's intentional (on the institution's part) there is not much to do (except not using / forbid the service of course). However such action would seriously damage the firm's reputation and business (not counting the inevitable lawsuits). The damage caused on the rivals would be insignificant compared to the reputation loss even if they try to blame some external party. Nation states may force firms to cooperate (there are examples) but they probably want spying instead of DDoS.
    – goteguru
    Jun 11, 2021 at 20:43
2

Yes it is possible.

In fact that is exactly what was done in the DDoS against GitHub in 2015. The javascript files served by Chinese search engine Baidu were hijacked by China's Great Firewall to include malicious code to DDoS GitHub. The browsers of all users that visiting Baidu (or any website that used Baidu's analytics) would send HTTP requests to GitHub, resulting in a massive DDoS of 1.3Tbps.

However, the javascript did not originate from Baidu itself, but rather was injected by an intermediate service.

Improve this answer
4
  • This is not an example of a service modifying code to create a DDoS. This is a straight-up DDoS attack from the middle.
    – schroeder ♦
    Jun 10, 2021 at 15:59
  • @schroeder A device at China's border modified Baidu's code to create a DDoS. Does it matter that it wasn't Baidu itself that did it?
    – nobody
    Jun 10, 2021 at 16:01
  • Code in transit, At that point, it's no different from generating the traffic themselves. They just used Baidu as cover.
    – schroeder ♦
    Jun 10, 2021 at 16:02
  • @schroeder No they didn't generate traffic themselves. They modified the javascript served by Baidu, so that the browsers/clients using Baidu would send HTTP requests to DDoS GitHub. That is exactly what OP asked about.
    – nobody
    Jun 10, 2021 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .