A presentation I gave at FraudCon on June 28 2017, an event which was part of CyberWeek Israel. Discussing automated fraud in the hands of attackers against commerce websites, and some ways to fight them back.

1. Automated Fraud
June 28th 2017

2. -
-
-
-
- Account takeover and abuse
- Price and content scraping
- DDOS
- Ad fraud
What are bots?
2

3. Bot evolution: bots are evolving rapidly
Gen 4 Bots - Infected Users
Hijacked Browsers, Fake Extensions
Gen 3 Bots - Headless Browsers
Javascript, Cookies, Engine Automation
Gen 2 Bots - Scripts + State
No Javascript, Cookies
Gen 1 Bots - Scripts
No Javascript, No Cookies

4. Websites are the new bank
▪
▪
▪
▪

5. 5
The Attack Vector
BOT ATTACK
ATO attack
8% Success (varies
based on database)
Yahoo! 1B
MySpace 360M
LinkedIn 164M
Adobe 153M
Badoo 112M
VK 93M
Dropbox 69M
Tumblr 65M
Mod Bus Soln 59M
Login databases stolen
100K accounts / $10
Validated account ~$3
Site fraud
BOT ATTACK
▪
▪
▪

6. 6
They come in large numbers...
Botnet Attack
▪
▪
▪
▪ 77% of this attack
would go unnoticed
by volumetric
detection

7. 7
… and from everywhere
Gen 2 Bots
No Javascript, Cookies
IoT Device Attack
▪
▪
▪
▪

8. ROI
▪
▪

9. How To Fight Back
9

10. Basic techniques
10
▪ Support multi-factor-authentication
▪ Encrypt or hash stored credentials
▪ Have good password practices
Don’t be one these guys
http://badpasswordpolicies.tumblr.com/

11. Monitor correctly
▪ Separate API from website – different endpoint URL
▪ Monitor logins for anomalies and spikes
▪ Lookup suspicious user-agents in github (and not just google)
http://mstajbakhsh.github.io/Microbot/
11

12. Detect
12
▪ Validate user is running javascript
▪ Validate a cookie
▪ Device fingerprint (https://github.com/Valve/fingerprintjs2)
▪ Track legitimate flow

13. Recommended resources
▪ Have I been Pwned by Troy Hunt - https://haveibeenpwned.com/
▪ Biggest breaches -
http://www.informationisbeautiful.net/visualizations/worlds-biggest-da
ta-breaches-hacks/
▪ Detection labs - https://github.com/PerimeterX/bot-tools
▪ Device Fingerprinting - https://github.com/Valve/fingerprintjs2)