0

We have a website which appeared to suffer from a denial of service attack. There were several IP addresses involved and these were all registered to Facebook.

Here's an excerpt from the Apache log files:

173.252.73.119 - - [29/Aug/2013:14:22:14 +0100] "GET /blog/?s=224im089cz+pofmv90+4445u422bmw+5iaa1nxh4j1+ppabi%2Gjewl_biochemist++ HTTP/1.1" 200 179 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"

As you can see the requested URL is valid but contains a gibberish query string. There are hundreds of such requests per second.

I am thinking that both the IP address and the referrer are faked. Even if the above URL had been posted/shared on Facebook it wouldn't explain all of the other thousands of random requests coming from the same IP address and referrer.

Whilst we could block the IP address via our firewall there are other IP addresses being used (all registered to Facebook), and we don't want to block Facebook if they're not actually responsible.

Are the source of these attacks likely to be coming from elsewhere and how can we mitigate against them?

  • Did you notice there's a link in the query string, https://www.facebook.com/externalhit_uatext.php. Did you try going to it to see what it had to say? – David Schwartz Aug 29 '13 at 18:19
  • Yes I did, but it still doesn't explain why there were hundreds of requests a second - tens of thousands per hour, for nonsense URL's on a website that isn't that popular. I find it highly unlikely that a large number of Facebook users would genuinely share such a large number of links that contain such spurious query strings on the end. – MrCarrot Aug 29 '13 at 21:18
5

Those hits are when Facebook queries your server to grab images or text excerpts, to name a few things. If a link was posted and went viral, for example, it'd be loaded by every view of said link. You can contact legal@facebook.com so they can look at it and maybe determine if the links are actually valid.

Note that this isn't a denial of service attack, but your server being unable to cope with an influx of traffic. Denial of Service attacks would serve nothing more than to make your site unusable, while this is just a busy server.

| improve this answer | |
  • As far as I know, Facebook makes a request for the content when it's posted/shared on Facebook, not every time it's viewed. So if I posted a link on Facebook once and it's viewed 10 times, it would be requested from the server in question once and cached, not 10 times (I think my understanding of this is correct). Since there are hundreds of requests every second for nonsense URL's it is causing a denial of service because the server load is so high it cannot deal with legitimate requests. – MrCarrot Aug 29 '13 at 20:07
0

I don't think it's facebook.

Have you tried to access exactly this URI - it may also be that the server is compromised and that in fact there is something listening here. You get a HTTP status 100 here - something is going on - this is not a File not Found.

And please look at it deeply - if you have a webshell installed it is hidden. Look here near the end on how this could look like: http://daniel-khan.at/index.php/2013/05/12/webserver-attack-deconstructed/

In all other cases (this is really a bogus URI pointing to nothing):

If you get really many hits you can use iptables with limit http://thelowedown.wordpress.com/2008/07/03/iptables-how-to-use-the-limits-module/

If blog isn't a valid path at all try to block it in .htaccess

<Directory /blogn>
Order Deny,Allow
Deny from all
</Directory>

This way the server will not get too much load and the bots get tired maybe.

| improve this answer | |
  • /blog/ is a valid path and the URI is returning a response code of Found 200. It's the query string that is bogus, although this doesn't have an effect on the page that's ultimately loaded. – MrCarrot Aug 29 '13 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.