Anonymous has a new tool in its arsenal that transforms casual
Web surfers into unwitting participants in a distributed denial of service attack, according to security experts. The loosely-knit group of activist hackers has embedded
JavaScript into specially crafted
Websites to redirect site visitors to the targeted site,
Graham Cluley, senior technology consultant at Sophos, wrote on the
Naked Security blog Jan. 20. The page repeatedly attempts to access the target Website for the entire time the browser window is open, which only adds adding to the traffic bombardment. Anonymous distributed links to these specially crafted Web pages via its Twitter feed which was re-tweeted widely, and links also popped up on
Internet Relay Chat rooms, Facebook, Tumblr and other social networking sites. Some of the links led to PasteHTML.com, a site that looks a little like the popular text-sharing site Pastebin frequently used by Anonymous to issue statements. A variation of this method allowed users to type in the
IP address of target Web servers before the JavaScript code began executing. Most of the links were obscured using
URL shortening services such as bit.ly. Several Anonymous Twitter accounts have thousands of followers, and some gained "hundreds of thousands of new fans overnight" during the course of the campaign, according to Cluley. The new method appears to have helped knock Universal Music and other sites offline during last week's
MegaUpload-revenge attacks. "If you visit the Webpage, and do not have JavaScript disabled, you will instantly, without user interaction, begin to flood a Website of Anonymous's choice with unwanted traffic, helping to perpetuate a
DDoS attack," Cluley said. Internet users who have disabled JavaScript on their browser would not have been caught in this trick. However, considering how many Websites require JavaScript to do the simplest tasks nowadays, most people have the scripting language enabled. This is yet another reminder to be careful about clicking on links online. URL shorteners make it really hard to tell where the link originated from or its intended purpose. Even if a friend posted the link on the social network, if the original source is Anonymous, it may not be that safe. "Don't forget, denial-of-service attacks are illegal. If you participate in such an attack you could find yourself receiving a lengthy jail sentences," Cluley warned.
