— J’raxis

Sorry, I was sort of confused by the article. Great topic, of course, but the author was obviously distracted into writing thinly veiled "blogs suck but at least xanga and lj are on their own domains" and "slashdot sucks, and now, it really sucks" and... well... boring comments like that, instead of telling us more.

So let me get this right: 1) Xanga has an inadequate user verification system, 2) given that, they let anyone post completely unfiltered HTML in comments, and 3) people spam the Xanga sites with comments containing iframes to, say, slashdot search, or other intensive CGI scripts that, when called too often, bring too much load to the server? (It wasn't clear that this problem was comment-spam related; speak of "hackers" made me guess they're actually modifying the page templates. Comment spam is an old trick. Not very l33t at all, if you want my spurious opinion as a non-expert of the hAx0r field. But I suppose some d00dz still get kicks out of them...)

Um... wait, that was a bit more boring. Anyway, maybe the lesson learned here is pretty simple: Allowing external references (images, iframes, whatever) in blog comments is a very risky idea at best and stupid at worst.

But there's also one small problem - comment content validation in itself is tricky to implement and needs more than some processor, too... which, of course, is not an excuse to allow people to use any HTML in the comments.

Okay, this was a boring comment...

-- Weyfour WWWWolf, a lupine technomancer from the cold north...

is it brand spanking new(tm)?

and so i wonder what would happen if someone pointed this at google or cnn or verisign for example

as this article demonstrates well (thanks submitter, very cool story), the effectiveness of the attack on the server is not dictated by bandwidth, but by cpu-intensive page targets

slashdot makes for the perfect first try at this kind of attack since it is the ultimate "i'm an antisocial geek loser look at my l33t ski11z" chest thumping arena

but what next?

if this kind of attack is new, then i can make a prediction: someone will use this clueless blog surfer (no shortage there) bot recruiting method to query a database intensive page on a website that is more than just a "look at me i took down slashdot i live in my parents basement i'm a dork" kind of target, but something much more serious

However, this does suggest a neatly symmetric way of dealing with the problem: perform the same trick, but instead of hosting it on Xanga, host it on Slashdot.

Slashdot uses IFRAME-based ads. The ads are hosted on ads.osdn.com but Slashdot ad purchasers may insert any html they like into the ad space and are encouraged-- in fact basically required-- to use this space to reference content hosted on third party servers. If one were to place an IFRAME reference to a database-intensive page on Xanga into a Slashdot ad, and possibly set the enclosing IFRAME such that the inner one periodically reloads, it is highly unlikely OSTG would notice anything unusual were happening before the purchased ad impressions were exhausted.

AZN p|21d3, 12 year olds, and almost universally painful to look at.

Xanga as a whole is probably below furry websites, I think, and only above those forums that SomethingAwful digs up where people discuss in broken English their incestual relations with retarded DragonballZ fans.