“The DDoS attack was enabled by a Persistent XSS vulnerability that allowed the offender to inject JavaScript code into the <img> tag associated with the profile image. As a result, every time the image was used on one of the the site’s pages (e.g., in the comment section), the malicious code was also embedded inside, waiting to be executed by every future visitor to that page.” reports the official post by Incapsula.

The scheme of attack is very interesting, The attacker  injected an ‘onload‘ call in the <img> tag, once a legitimate user visits any webpage on the vulnerable website (e.g., in the comment section) the JavaScript code injected in the attacker’s image is executed by the victim’s browser which in turn injected a hidden iframe with the address of the DDoSers C&C domain. To run the attack the hackers just need to post comments on the popular video pages, the DDoS attack could be improved if the publishing of comment is executed automatically by a large botnet which orders thousands of hijacked browsers.

“Obviously one request per second is not a lot. However, when dealing with video content of 10, 20 and 30 minutes in length, and with thousands of views every minute, the attack can quickly become very large and extremely dangerous. Knowing this, the offender strategically posted comments on popular videos, effectively created a self-sustaining botnet comprising tens of thousands of hijacked browsers, operated by unsuspecting human visitors who were only there to watch a few funny cat videos.”

The duration of the involvement of victims in the DDoS attack is directly linked to the duration of the requested video as explained in the official blog post, The Javascript is “session long” but these can be 20 or even 30 min videos so the sessions are much longer than usual.

“Obviously one request per second is not a lot. However, when dealing with video content of 10, 20 and 30 minutes in length and with thousands of views every minute, the attack can quickly become very large and extremely dangerous.” researchers explained.

In time I’m writing Incapsula hasn’t revealed the name of vulnerable, it is only known that it allows its users to sign-up and sign-in with their own profiles.