What are Malicious Bots? Are you safe from them?
Bots are the short form of “robot”
and it also called 'Internet Bot'. A bot is normally used as an agent for a user
or other software program, or to stimulate human activities. As an agent, bots
work with certain instructions given by humans and try to automate certain
tasks on behalf of the human.
Bots are normally operated over
the network. They can communicate with one another using internet facilities through instant messaging. In general, bots interact with web pages, talk with end-users,
scan for content, and help users to get their task done. Here the advantage is that
humans can get rid of repetitive actions and tasks they do in working
environments and spend their time in a more efficient manner. Each bot that
performs on the internet has an underline algorithm that specifies certain tasks that need to be done by the bot. There are plenty of different types of bots nowadays and people use
them to accomplish various goals. A 'chatbot' is the one most popular bot type, that gives
certain pre-defined prompts and asks users to select them accordingly. An intellectually
independent chatbot will make use of machine learning and Natural Language Processing
(NLP) to learn from human text inputs and trying to capture the meaning using
popular keywords.
Other than making human activities
easy some bots are used to automate cybercrimes. These bots are called ‘Malicious
Bots’.
Malicious Bots
A malicious bot is a malware often
used by cybercriminals to infect a host machine or to steal information. The
threats of these malicious bots can be found on the internet in many forms such as Distributed
Denial of Service Attacks (DDOS attacks), spam distributors, content
duplication, hacking, etc. Some of these bots work as web scrapers and save them
offline to make them useful for various stalking and malicious tasks.
The malicious bots can be divided into various types by the tasks, they are being used.
1. File-sharing bots
These bots make use of the user’s query term that recently typed and responds to the query stating that they have the file available for download with a link. When the user clicks on these links and downloads the files to their machines, without the awareness of the user the computer is getting infected.
2. Scraping bots
Scraper bots read data from
websites enabling further use of that data in malicious activities. These data
can be accessed offline after the scraping. Scraping can be done on web page
items including names of the people, places, prices, and specific data points.
Web scraping cannot be considered
as a malicious task in some cases because some website owners allow web scraping
to use that data in further analysis to improve their business processes. In other cases, bot operators may be violating website terms of use to steal
sensitive or copyrighted content without the permission of the website owners.
3. Zombie Bots
This refers to a computer that
has been compromised, along with hundreds or thousands of other computers, as
part of a botnet. The users may even not know that they have infected. These types
of malicious bots can not identify easily because they work as a group and
perform malicious tasks.
4. Spambots
A spambot is designed to gather email addresses from different websites, businesses, and organizations identifying the format of email addresses. Then they use email addresses and circulate spam emails. Further, spambots work independently and spread spam to generate traffic to certain websites.
In 2016, according to Imperva,
94.2% of all websites experienced a bot attack. For the most part, these
attacks are weak, they are just doing attacks and scrape data for fun and they
may not critical attacks. But cybercriminals doing wide-range attacks using bots
to look for vulnerabilities in the websites. Targeted attacks are not easy to deal
with but are far less common than these smaller automated attacks which are
used to detect flaws in security or unprotected websites.
How to safeguard your applications
from bot attacks?
1. Protect the exposed access points - Always be sure to protect API endpoints and mobile applications backend services. Just doing front end protection for websites may not enough when it comes to a botnet attack prevention, close the backdoors paths, not supplying easy access paths to attackers.
2. Carefully evaluate traffic sources - Monitor traffic sources for your websites. If you see any high rates of traffic suddenly not in peak hours this could be traffic caused by bots.
3. Investigate traffic spikes - When there are traffic spikes be sure to identify the source of spikes even it may be a good sign for your business. Sometimes bots are causing traffic unnecessary and it may be difficult to identify who caused the traffic.
4. Monitor for failed login attempts - Harden failed login attempts policies to avoid bots' attempts to log in to the systems. Also, monitor for anomalies or spikes.
5. Monitor increases in failed validation of gift card numbers - An increase in failures to gift card validation pages can be a signal that bots such as ‘GiftGhostBot’ are attempting to steal amounts.
6. Block outdated user agents/browser strings - The default configurations for many tools and scripts contain user-agent string lists that are largely outdated. It might catch and discourage low-level attackers. Most modern browsers force auto-updates on users, making it more difficult to surf the web using an outdated version.
7. Pay close attention to public data breaches - Newly stolen credentials are more likely to still be active then these credentials may use in bot attacks to the websites.
References
Good writing Suranga! Keep it up.
ReplyDeletecan you tell more on some tools that can be used in botnet detection?
Thank you Sanduni..
DeleteYou can refer more on tools from the below website. They have explained about tools and techniques that can be used in botnet detection.
https://www.computerweekly.com/tip/Four-handy-botnet-detection-techniques-and-tools-A-tutorial
Nice flow Suranga. Can you share on what a bot herder is and how it is related to malicious bots?
ReplyDeleteA bot herder is a hacker that seeks out vulnerable computers and infects them so that they can be controlled as a botnet. Bot herders may also be bot masters, they may also involves in distributed denial of service (DDOS) attacks, running click fraud or ad fraud schemes or propagating malware.
DeleteDoesn't google captcha help to track robots?
ReplyDeleteTo my underatnding, Earlier they helped to track bots using cursor movements and the speed of selection, but now adays bots gets pass CAPTCHAs because of AI training and visual recognition systems.
DeleteIn the near future, the motivation behind attacks will increase further. We face economically and
ReplyDeletepolitically motivated attacks, as well as attacks aimed at gaining publicity. Your post is a good initiative for that discussion. Good work Suranga!
Thank you ruvishka
Delete