■Threats and trends

Bots are generally tools that perform automated tasks, and they are very useful tools. On the other hand, bots are often abused. Such bots are called "malicious bots" and they mechanically access websites and negatively impact business.
Examples of malicious bots are shown below.

• scraping
  Information published on websites can be efficiently collected by scraping. Competitors seeking to gain a competitive advantage may steal your information or try to get the lowest price.
  
• Skillping
  Because bots can automatically execute operations on web applications, scalping using malicious bots is occurring frequently on e-commerce sites. As a result, general users cannot get what they want to purchase, resulting in a decline in customer satisfaction and brand image, leading to user abandonment. From an e-commerce site's perspective, this will result in sales, but if scalping by malicious bots is left unaddressed, it will ultimately have a negative impact on business.
  
• Account takeover (ATO)
  For many services, what you need to log into your account is an ID and password. If an attacker uses a bot and repeatedly attempts to log in to confirm success or failure, there is a possibility that the account ID and password will be stolen (account hijacking).
  

Malicious bots are used for such fraudulent activities.
Furthermore, data shows that malicious bot communications are increasing year by year, and account for approximately 30% of all internet traffic. As the number of malicious bots increases, many anti-bot solutions have been developed, but there are also sophisticated bots that can evade such countermeasures.

■About countermeasures

To combat malicious bots, it is essential to have a dedicated solution that can identify and block malicious bots with high accuracy. This is because it is important not only to block communications from malicious bots, but also to not affect the usability of the site or non-malicious communications. For example, CAPTCHA authentication is very commonly used to distinguish between bots and people, but it requires a very tedious task for users, which can lead to users turning away. It can also block non-malicious bots such as Google crawlers. Advanced, dedicated protection solutions provide effective protection against malicious bots.

■Threats and trends

DDoS attacks are attacks that place a significant load on services. Additionally, web services are made up of various elements, and if one of them goes down due to a DDoS attack, the entire web service will be affected. Therefore, countermeasures must be taken for all elements that make up the web service. In particular, countermeasures are extremely important because the impact range is large when the web server itself or DNS server goes down.

In fact, cases of damage caused by DDoS attacks are increasing, and their targets are becoming more diverse. DDoS attacks from all angles against web services are increasing, including Layer 7 DDoS attacks targeting the application layer, Layer 3-4 DDoS attacks targeting the network layer, and DDoS attacks against DNS services. Defense methods for DDoS attacks differ depending on the target, so countermeasures suitable for each attack are required.

Additionally, the purposes for which attackers conduct DDoS attacks are diversifying, and for example, the following DDoS attacks have been increasing in recent years.

• Ransom DDoS: RDoS (Ransom DDoS)
  There have been reports of attackers continuing DDoS attacks, demanding ransoms, and conducting DDoS attacks in order to obtain money.
• DoW (Denial of Wallet) attack
  There are cases where cybercriminals target serverless applications such as pay-as-you-go Cloud services and try to inflate payments to cloud providers.
• DDoS as a smokescreen
  We have observed cases where DDoS attacks are used as a smokescreen to carry out attacks that are highly profitable for the attacker, such as account takeover (ATO), after or during the attack.

DDoS attacks like this can target anyone at any time. Additionally, with the increase in DDoS attack services (CaaS: Cybercrime-as-a-Service), anyone can easily carry out large-scale DDoS attacks. By industry, DDoS attacks against financial services tend to be the most likely to increase, but similar trends can be seen across all industries. Additionally, not only the number of attacks but also their scale has grown, with the largest DDoS attack observed by Imperva in 2022 being more than three times the size of the previous year.

■About countermeasures

Regarding DDoS attacks, it is important to take measures to maintain services without affecting general users even in the event of a DDoS attack. However, the content of DDoS attack communications itself may be the same as that of general users, making it difficult to identify attack communications. Therefore, for DDoS countermeasures, it is essential to have a solution specifically designed for DDoS attacks that has functions such as detecting attack communications with high precision in real time, quickly mitigating and minimizing downtime, alert notifications, and displaying analysis and results. is.

■Threats and trends

Many familiar web services, including online payments, which are now indispensable in daily life, are based on web APIs. Because APIs often handle confidential information such as personal information, attacks targeting APIs are becoming a trend. Additionally, APIs are often released with security risks in them, and incidents such as personal information leaks have actually occurred in countries around the world. Therefore, it is important to implement measures with dedicated solutions for APIs as well.

■About countermeasures

During API development, the development team continually adds features to the API. The security team is required to work with the development team to implement API security measures during both the development and operation phases. To further strengthen API security, it is important to visualize API risks and detect and block unauthorized communications based on the actual communication destination and request content.

For more information on API security, please take a look at our separate blog.
https://mnb.macnica.co.jp/2023/02/post-32.html