Mobile Ad Networks as DDoS Vectors: A Case Study

Re:Mobile Ad Networks as DDoS Vectors: A Case Study by javajosh on Monday September 28, 2015 @01:41PM (#10291771)

I think it's instructive to consider the smallest possible malicious program of this type, which involves only the use of a basic control structure and the ability to initiate a request. The control structure could be setInterval, a while or for loop; the request initiation can be an ajax call, or certain dom manipulations (like altering img.src or script.src).

Questions: did I miss something? Can you write a program that either a) detects these cases or b) provides a reasonable sandbox?

[ Parent | on HN ]

Re:Mobile Ad Networks as DDoS Vectors: A Case Study by mox1 on Monday September 28, 2015 @01:54PM (#10291856)

Yes, I'm sure you could pretty easily write said program. Then the people who did this would obfuscate their code and you could probably then detect that...and the game whack-a-mole will continue. Eventually as this cycle continues you will end up with something that looks a lot like today's anti-virus programs, (aka a pattern recognition engine...).

It's the (theoretical?) software that can detect these types of attacks before or as they are happening that is of interest to lots of people now a days.

[ Parent | on HN ]

Re:Mobile Ad Networks as DDoS Vectors: A Case Study by javajosh on Monday September 28, 2015 @07:06PM (#10293774)

I don't see how code obfuscation would help you defeat sand-boxing.

[ Parent | on HN ]