Code review of a suspected ActivityPub DDoS program

December 7, 2022•2,335 words

Experienced on 2022-12-06

I found this crappy code at the root of a website that popped out seemingly of nowhere in the last few days, and is causing DDoS attacks (both directly and indirectly) to ActivityPub servers. Or so it seems. I decided to ask ChatGPT for advice on the matter.

I won't paste the original code here, but you can find it at http://web.archive.org/web/20221203200841/http://activitypub-troll.cf/.

Please explain what this program is doing:

[Copypasted code - REDACTED]

This program is a server-side script that is likely used to handle HTTP requests to a website. It is written in JavaScript and uses the Node.js runtime environment.

The script first imports the fs and http modules from the Node.js core library. It then defines a rand function that returns a random string of characters and a server object that listens for HTTP requests and responds to them.

When a request is received, the server first logs the date, the IP address of the client, the hostname, the URL, and the user agent string to the console (assuming that the PROD environment variable is not set). It then checks the URL of the request and responds accordingly.

If the URL starts with /.well-known/webfinger?resource=acct, the server returns a JSON-formatted string that includes various links and aliases for a user account.

If the URL starts with /users/, the server responds with a JSON-formatted string that contains information about the user, such as their profile page, posts, and contact information.

Overall, this script appears to implement some of the basic functionality required to support the OStatus protocol, which is a federated social networking protocol that allows users on different servers to interact with each other.

I'm not sure, but I think this code is being used to commit DDoS attacks to the ActivityPub network. Can you analyze it better and tell me if you think this is the case?

It is not possible for me to determine with certainty whether this code is being used for DDoS attacks on the ActivityPub network, as that would require knowledge of the context in which the code is being used and access to information about the network and its activity.

However, based solely on the code itself, I can say that it does not contain any functionality that would directly enable DDoS attacks. The code simply sets up a server that listens for HTTP requests and responds to them in a manner that is consistent with the OStatus protocol.

It is possible that the server running this code could be used as part of a DDoS attack if it were to receive and process a large number of requests in a short amount of time, potentially overwhelming the server and causing it to become unresponsive. However, this is not something that is explicitly enabled or facilitated by the code itself.

If I'm understanding what is happening, this leverages a vulnerability of the ActivityPub protocol, responding with an unlimited number of user data when a legit server tries to get information about an user. This user data links to other user profiles which link to other profiles and so on, indefinitely. This causes the legit ActivityPub server to have to handle an unlimited number of "store user in database" operations, leading to slowdowns and crashes.

By analyzing the code, do you think this is what is happening?

Based on the code you provided, it does not appear that the server is intentionally exploiting a vulnerability in the ActivityPub protocol. The code simply implements a server that responds to requests in a manner that is consistent with the OStatus protocol, which is a predecessor to the ActivityPub protocol.

It is possible that the server running this code could be used to cause slowdowns or crashes on another server if it were to receive and process a large number of requests in a short amount of time. However, this would not be due to any intentional exploitation of a vulnerability in the ActivityPub protocol, but rather a consequence of the server being overwhelmed with requests.

Additionally, the code does not appear to contain any functionality that would cause it to generate an unlimited number of user data or link to other user profiles indefinitely. It simply responds to requests for user data with a JSON-formatted string that contains information about the user and some links to their profile and posts.

Add some comments to the code I sent you

Here is a version of the code with some added comments to explain what is happening in each part of the script:

// Import the 'fs' and 'http' modules from the Node.js core library
var code = require("fs").readFileSync(__filename, "utf8");
var rand = () => (Math.floor(Math.random() * 1e13)).toString(36);

// Create a new HTTP server that listens for requests and responds to them
var server = require("http").createServer(function(req, res) {
  // Log the request to the console (if the 'PROD' environment variable is not set)
  if (!process.env.PROD) console.log(new Date().toLocaleString(), req.headers["x-forwarded-for"], req.headers.host, req.url, '"'+req.headers["user-agent"]+'"');

  // Check the URL of the request and respond accordingly
  if (req.url.startsWith("/.well-known/webfinger?resource=acct")) {
    // Decode the URL and extract the user's name
    var c = decodeURIComponent(req.url.substring(36));
    var name = c.substring(1, c.indexOf("@"));

    // Return a JSON-formatted string that includes links and aliases for the user's account
    res.writeHead(200, {"Content-Type": "application/json; charset=utf-8"});
    res.end(JSON.stringify({
      "aliases": [
        "https://"+req.headers.host+"/users/"+name+""
      ],
      "links": [
        {
          "href": "https://"+req.headers.host+"/users/"+name+"",
          "rel": "http://webfinger.net/rel/profile-page",
          "type": "text/html"
        },
        {
          "href": "https://"+req.headers.host+"/users/"+name+"",
          "rel": "self",
          "type": "application/activity+json"
        },
        {
          "href": "https://"+req.headers.host+"/users/"+name+"",
          "rel": "self",
          "type": "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
        },
        {
          "rel": "http://ostatus.org/schema/1.0/subscribe",
          "template": "https://"+req.headers.host+"/ostatus_subscribe?acct={uri}"
        }
      ],
      "subject": "acct:"+name+"@"+req.headers.host+""
    }))
  }

  else if (req.url.startsWith("/users/")) {
    // Extract the user's name and any sub-URL from the request
    var t = req.url.indexOf('/', 7);
    if (t === -1) t = undefined;
    else var suburl = req.url.substring(t);
    var user = req.url.substring(7, t);

    // If no sub-URL is present,