Reign of Botnets

David Sénécal is a Principal Product Architect at Akamai Technologies, leading a team of researchers, developers, and data scientists to build the next generation of fraud and abuse products. He has over twenty years of experience in network and web security and has dedicated the last 14 years to building bot management products. He’s a regular blogger and speaker at events like the OWASP Global Appsec conference. He was integrally involved in the development and maturation of the bot management concept in the cybersecurity industry.

• Introduction xvii Chapter 1 A Short History of the Internet 1From ARPANET to the Metaverse 2The Different Layers of the Web 7The Emergence of New Types of Abuses 9The Proliferation of Botnets 11Quantifying the Bot Traffic Volume on the Internet 14Botnets Are Unpredictable 16Bot Activity and Law Enforcement 18Summary 19Chapter 2 The Most Common Attacks Using Botnets 21Account Takeover 22Data Harvesting 23Credential Harvesting 26Account Takeover 31Targeted ATO Attacks 34A Credential Stuffing Attack Example 35Account Opening Abuse 38The Tree Hiding the Forest 39Fraud Ring 41Web Scraping 48The Intent Behind Scraping by Industry 49Good Bot Scraping 51Inventory Hoarding 53Business Intelligence 55Scalping: Hype Events 58Online Sales Events Mania and Scalping 58The Retailer Botnet Market 59Anatomy of a Hype Event 61Carding Attacks 64Gift Cards 65Credit Card Stuffing 66Spam and Abusive Language 66Summary 67Chapter 3 The Evolution of Botnet Attacks 69Incentive vs. Botnet Sophistication 70HTTP Headers 101 71Common HTTP Headers 71Legitimate Browser Signatures 74Header Signatures from Bot Requests 75The Six Stages of a Botnet Evolution 77Stage 1: Deploy the Botnet on a Handful of Nodes Running a Simple Script 77Stage 2: Scale the Botnet and Impersonate the Browsers' Header Signatures 79Stage 3: Reverse Engineer JavaScript and Replay Fingerprints 80Stage 4: Force the Web Security Product to Fail Open 81Stage 5: Upgrade the Botnet to a Headless Browser 82Stage 6: Resort to Human/Manual Attack 84Botnets with CAPTCHA-Solving Capabilities 85Human-Assisted CAPTCHA Solver 85Computer Vision 88The CAPTCHA Solver Workflow 88AI Botnets 89The Botnet Market 91Summary 93Chapter 4 Detection Strategy 95Data Collection Strategy 96Positive vs. Negative Security 98The Evolution of the Internet Ecosystem 99The Evolution of Detection Methods 100Interactive Detection 100Transparent Detection 103The State of the Art 106Transparent Detection Methods 108Good Bot Detection 109Good Bot Categories 111IP Intelligence 115Cookie Handling 118JavaScript Execution Handling 119Device Intelligence 120Proof of Work 123Behavioral Biometric Detection 125Headless Browser Detection 128User-Behavior Anomaly Detection 130Email Intelligence 135Advanced PII Data Assessment 140Risk Scoring 142Formula 143Consuming the Risk Score 144Summary 145Chapter 5 Assessing Detection Accuracy 147Prerequisites 148High-Level Assessment 149Website Structure 150Website Audience 151Types of Clients 151Assessing the Shape of the Traffic 152Quantitative Assessment (Volume) 155Feedback Loop 156Response Strategy Assessment 158Low-Level Assessment 158IP Intelligence 159Device Intelligence 163Assessment Guidelines 168Identifying Botnets 170Botnet Case Study 173The Evening Crawler 174The Sprint Scraper 175The Night Crawler 176The Cloud Scraper 177Summary 177Chapter 6 Defense and Response Strategy 179Developing a Defense Strategy 180Do-It-Yourself 180Buying a Bot Management Product from a Vendor 182Defense in Depth 184Technology Stack to Defend Against Bots and Fraud 186Detection Layer to Protect Against Bot Attacks 186Detection Layer to Protect Against Online Fraud 188Response Strategies 189Simple Response Strategies 190Advanced Response Strategies 191Operationalization 193Mapping a Response Strategy to a Risk Category 193Preparing for Special Events 195Defending Against CAPTCHA Farms 196Summary 197Chapter 7 Internet User Privacy 199The Privacy vs. Security Conundrum 199The State of Privacy and Its Effect on Web Security 201IP Privacy 201Cookie Tracking Prevention 204Anti-fingerprinting Technology 206The Private Access Token Approach 213The High-Level Architecture 214The PAT Workflow 214PAT Adoption 216Summary 218References 219Index 223