Using Facebook Servers to Generate 900MBPS Attacks

Using Facebook Servers to generate 900MBPS attacks
Facebook Notes allows users to include tags. Whenever a tag is used, Facebook crawls the image from the external server and caches it. Facebook will only cache the image once however using random get parameters the cache can be by-passed and the feature can be abused to cause a huge HTTP GET flood.

Steps to re-create the bug as reported to Facebook Bug Bounty on March 03, 2014.

1. Create a list of unique img tags as one tag is crawled only once:
   
   

   Quote:
   
   ..
   

2. Use m.facebook.com to create the notes. It silently truncates the notes to a fixed length.
3. Create several notes from the same user or different user. Each note is now responsible for 1000+ http request.
4. View all the notes at the same time. The target server is observed to have massive http get flood. Thousands of get request are sent to a single server in a couple of seconds. Total number of facebook servers accessing in parallel is 100+.
   

Image has been scaled down 2% (700x313). Click this bar to view original image (714x319). Click image to open in new window.