DDoS attacks remain one of the most discussed topics in the field of information security. However, not everyone is aware that bot traffic, which is the tool for these attacks, brings many other dangers to online businesses. Cybercriminals can use bots not only to take a website down but also to steal data, distort business metrics, increase advertising costs, and damage the site's reputation. Let's take a closer look at these threats and remind ourselves of basic protection methods.
Parsing
Bots continuously scrape (i.e., collect) data from external websites. They steal content to later publish it without any attribution to the original source. This placement of copied content on external sites pushes the source site down in search rankings, leading to reduced audience size, sales, and advertising revenue. Bots also monitor prices to sell products cheaper and lure clients away. They purchase various items to resell at a higher price. They can create false orders to overload logistical resources and make products unavailable to users.
Scraping significantly impacts the operations of online stores, especially those whose primary traffic comes from aggregator sites. After scraping prices, cybercriminals set the product price slightly lower than the original, allowing them to rise significantly in search results. Travel portals are also frequently targeted by bot attacks: they steal information about tickets, tours, and hotels.
In general, the moral is simple: if your resource has unique content, the bots are already heading your way.
scraping can be observed through sudden spikes in traffic and by monitoring the pricing strategies of competitors. If other sites immediately replicate your price changes, it's likely that bots are involved.
inflation
Inflated metrics are a side effect of bots being present on a site. Every bot action reflects on business metrics. Since the share of illegitimate traffic is significant, decisions based on resource analytics can often be erroneous.
Marketers study how visitors use the resource and make purchases. They look at conversion rates and leads to identify key sales funnels. Companies also conduct A/B tests and, based on the results, develop strategies for the website. Bots affect all these metrics, leading to irrational decisions and excessive marketing costs.
Malicious actors can also use bots to influence the reputation of platforms, including social media. The same situation applies to websites for online voting, where bots often inflate metrics to ensure the desired outcome preferred by the perpetrators.
How to detect inflations:
- Check the analytics. A sudden and unexpected spike in any metric, such as login attempts, often indicates a bot attack.
- Monitor changes in traffic sources. Sometimes, an unusually high number of requests from unexpected countries may appear on the site—this is strange if you haven’t targeted campaigns in those areas.
DDoS attacks
Many have heard about DDoS attacks or have even encountered them. It's important to note that a resource is not always taken down by high traffic. API attacks can often be low-frequency, and while the application fails, firewalls and load balancers operate as if nothing happened.
Tripling traffic to the homepage may not affect the website's functionality, but similar load directly on the cart page can cause issues, as the application starts sending multiple requests to all components involved in transactions.
How to detect attacks (the first two points may seem obvious, but should not be overlooked):
- Customers complain that the website is not working.
- The website or specific pages are loading slowly.
- There is a sudden increase in traffic to specific pages, with a large number of requests in the cart or on the payment page.
Hacking of personal accounts.
BruteForce, or password cracking, is carried out by bots using leaked databases. On average, users create no more than five password variations for all their online accounts — and these variations are easily guessed by bots that check millions of combinations in a short time. Cybercriminals can then resell the valid login and password combinations.
Hackers can also take control of personal accounts and use them for their own benefit. For example, they may withdraw accumulated bonuses, steal purchased tickets for events — in general, there are many options for further actions.
Recognizing BruteForce is not too difficult: an unusually high number of unsuccessful login attempts indicates that hackers are trying to breach an account. However, there are times when attackers send only a small number of requests.
Click Fraud
Click fraud by bots can lead to significant losses for companies if not detected. During an attack, bots click on ads placed on the site, thereby adversely affecting the metrics.
Advertisers clearly expect that the banners and videos placed on platforms will be seen by real users. But since the number of impressions is limited, due to bots, the ads are shown to fewer people.
Websites themselves hope to increase their revenue through ad impressions. And advertisers, when they observe bot traffic, reduce the volume of placements on the platform, resulting in both losses and damage to the platform's reputation.
Experts identify the following types of ad fraud:
- False impressions. Bots visit many pages of the website and generate illegitimate ad views.
- Click Fraud. Bots click on ads in search engines, leading to increased spending on search advertising.
- Retargeting. Before clicking, bots visit many legitimate sites to create a cookie that is more valuable to advertisers.
How to detect click fraud? Usually, after clearing traffic of fraud, the conversion rate decreases. If you notice that the number of clicks on banners is higher than expected, it indicates the presence of bots on the site. Other indicators of illegitimate traffic may include:
- Increase in clicks on ads with minimal conversion.
- Conversion is decreasing, even though the ad content has not changed.
- Multiple clicks from one an IP address.
- Low user engagement ratio (including a high bounce rate) despite the increase in clicks.
Searching for vulnerabilities
Vulnerability testing is performed by automated programs that look for weak spots in the website and API. Among popular tools are Metasploit, Burp Suite, Grendel Scan, and Nmap. The site can be scanned by services specifically hired by the company or by malicious actors. Companies may contract with hacking specialists to check their security. In such cases, the auditors' IP addresses are whitelisted.
Malicious actors test sites without prior agreement. Subsequently, hackers use the results of these checks for their purposes: for example, they might resell information about the site's vulnerabilities. Sometimes resources are scanned not intentionally, but as part of exploiting vulnerabilities in third-party resources. Take WordPress: if a bug is found in any version, bots search for all sites using that version. If your resource ends up on such a list, you can expect a visit from hackers.
How to detect bots?
To find vulnerabilities on a site, malicious actors first conduct reconnaissance, leading to an increase in suspicious activity on the site. Filtering out bots at this stage can help avoid subsequent attacks. While bots are hard to detect, a warning sign may be requests sent from one IP address to all pages of the site. It's also worth noting an increase in requests to non-existent pages.
Spam
Bots can fill out website forms with 'garbage' content without your knowledge. Spammers leave comments and reviews, create fake registrations and orders. The classic method of combating bots, CAPTCHA, is ineffective in this case, as it frustrates real users. Moreover, bots have learned to bypass such tools.
Most spam is harmless; however, sometimes bots offer dubious services: they post ads for fake goods and medicines, promote links to porn sites, and redirect users to fraudulent resources.
How to detect spam bots:
- If spam has appeared on your website, it's likely that bots are responsible for it.
- Your email list contains many invalid addresses. Bots often leave nonexistent email addresses.
- Your partners and advertisers are complaining that spam leads are coming from your website.
This article may suggest that fighting bots on your own is difficult. In reality, it is, and it's better to trust website protection to professionals. Even large companies often struggle to monitor illegitimate traffic and filter it, as this requires significant expertise and substantial IT team costs.
Variti protects websites and APIs from all types of bot attacks, including fraud, DDoS, click fraud, and scraping. Its proprietary Active Bot Protection technology identifies and blocks bots without CAPTCHA or IP address blocking.
Source: habr.com
