{"id":17846,"date":"2024-06-14T12:13:12","date_gmt":"2024-06-14T16:13:12","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=17846"},"modified":"2024-06-28T11:28:07","modified_gmt":"2024-06-28T15:28:07","slug":"researchers-blocked-6-trillion-requests-from-bad-bots-heres-what-they-found","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/researchers-blocked-6-trillion-requests-from-bad-bots-heres-what-they-found\/","title":{"rendered":"Researchers Blocked 6 Trillion Requests From \u2018Bad Bots.\u2019 Here\u2019s What They Found"},"content":{"rendered":"\n

Nearly half of internet traffic identified by Imperva isn\u2019t human; it\u2019s bots, and most are up to no good. Here\u2019s what they\u2019re doing and how you can identify them and fight back\u2026<\/h2>\n\n\n\n

Let\u2019s start by stating that not all bots are bad. After all, Google\u2019s search engine web crawlers<\/a> make indexing your new web pages possible. But when \u201cbad bots<\/a>\u201d engage in automated attacks against websites and\/or APIs to steal, damage, and defraud businesses and consumers, then it becomes a huge problem that must be dealt with ASAP. <\/p>\n\n\n\n

Just how big of an issue are these bots? Imperva\u2019s 2024 Bad Bot Report<\/a> data, which focuses on OSI Model layer 7<\/a> (i.e., application layer) bad bot activity, shows that nearly half of the internet traffic observed via the company\u2019s global network in 2023 stemmed from automated (i.e., non-human) sources. Bad bots represented nearly one-third of that traffic.<\/p>\n\n\n\n

When we\u2019re talking about nearly 6 trillion blocked bad bot requests in that period alone, it\u2019s easy to see why they\u2019re considered a significant threat. If each bad bot request counted as a separate second, those bad bot requests would add up to more than 189,000 years<\/a>!<\/p>\n\n\n\n

Knowing this, it\u2019s time to explore the threats bad bots pose to organizations globally and what you can do to stop them.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

A High-Level View of These Threats: What Imperva\u2019s Data Tells Us<\/h2>\n\n\n\n

Bad bot activity is on the rise and doesn\u2019t appear to be quitting anytime soon. Imperva\u2019s data tells us that total bot activity peaked in 2014, when nearly 60% of all internet traffic was comprised of bots (36.3% good bots, 22.8% bad bots). Now, compare this with the internet activities of us lowly humans \u2014 human-based actions were at an all-time low, accounting for just 40.9% of all internet traffic that year.<\/p>\n\n\n\n

Fast forward to 2019, when the combined good\/bad bot activity dipped to just over 37%. But that activity has been growing steadily since then, with bad bots having the upper hand over good ones. In 2023, bad bots (32%) and good bots (17.6%) accounted for nearly half (49.6%) of all internet traffic!<\/p>\n\n\n\n

But what are these bad bots capable of doing?<\/p>\n\n\n\n

Primary Bad Bot Uses and Actions<\/h3>\n\n\n\n

In their 2024 Bad Bot Report, Imperva researchers identified bad bot-related activities as the following use cases (first three columns of the table below). We\u2019ve broken these down these 10 use cases into four overarching categories (right column):<\/p>\n\n\n\n

Bad Bot Problem<\/strong><\/td>Definition<\/strong><\/td>Business Impacts<\/strong><\/td>Bad Bot Action Categor<\/strong>y<\/td><\/tr>
Price Scalping<\/td>Using bots to track and scrape product or service pricing information<\/td>Sales and revenue losses, decreased conversion rates, and brand reputational damages<\/td>Competitive Attacks<\/td><\/tr>
Content Scraping<\/td>Using bots to steal content and data from other sites<\/td>Loss of original content, SEO ranking drops, decreased site performance, and harm to brand reputation<\/td>Competitive Attacks<\/td><\/tr>
Account Takeover<\/td>Using bots to gain access to others\u2019 accounts illegally<\/td>Increased support and fraud-related costs, negative publicity and reputational harm, and decreased performance<\/td>Account Security Compromises<\/td><\/tr>
Account Creation<\/td>Using bots to automate create fake accounts for misuse and fraudulent activities<\/td>Revenue losses, brand and reputational damages, and potentially bad decision-making due to poor data<\/td>Account Security Compromises<\/td><\/tr>
Credit Card Fraud<\/td>Using bots to brute force credit card info verification<\/td>Regulatory non-compliance, reputational harm, financial losses, increased support requirements, and loss of customer relationships<\/td>Financially Focused Attacks<\/td><\/tr>
Denial-of-Service<\/td>Using bots to overload legitimate sites, web apps, and services with traffic<\/td>Revenue losses, poor performance, customer relationship losses, and brand and reputational harm<\/td>Product or Service Availability Hijacking<\/td><\/tr>
Gift Card Balance Checking and Abuse<\/td>Using bots to get their hands on gift card balances<\/td>Fraud-related financial losses, increased support requirements, reputational harm, and potential customer relationship losses<\/td>Financially Focused Attacks<\/td><\/tr>
Denial of Inventory<\/td>Using bots to shopping cart \u201csquat\u201d to prevent legitimate purchases<\/td>Sales and revenue losses, increased shopping cart abandonment rates, decreased conversions, reputational harm, and potential loss of customer relationships<\/td>Product or Service Availability Hijacking<\/td><\/tr>
Scalping<\/td>Using bots to obtain services or goods to the detriment of legitimate customers<\/td>Poor user experience, downtime or performance issues, decreased average basket value (ABV), and reputational harm that could impact customer relationships<\/td>Product or Service Availability Hijacking<\/td><\/tr>
Seat Spinning<\/td>Using bots to \u201cseat squat\u201d airline tickets to keep legitimate users from buying them<\/td>Revenue losses and reputational damage that could impact customer relationships<\/td>Product or Service Availability Hijacking<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Bad Bots + ATO = A Never-Ending Concern for Businesses<\/h2>\n\n\n\n

Account takeover (ATO) is one of the attack methods for targeting businesses favored by bad guys. This approach often involves attackers using bots to brute-force or credential-stuff their way into an account using lists of guessed or stolen passwords. Imperva\u2019s data shows that over the past two years, ATO attacks increased 10% from 2022 to 2023.<\/p>\n\n\n\n

As far as how often these attacks occur for businesses globally, the United States is leaps and bounds ahead of other countries. It ranks #1 as far as being targeted by the highest percentage of ATO attacks (40%). What can we say? While this rank isn\u2019t something to be proud of, we\u2019re not a country that likes to be outdone in virtually any category!<\/p>\n\n\n\n

Are you wondering which industry experiences the most ATO attacks? Financial Services took the gold. But if you were to consider the industry that experienced the highest ATO malicious login ratio, then Business Services (38%) is the so-called \u201cwinner.\u201d<\/p>\n\n\n\n

\"A
Data source: Imperva 2024 Bad Bot Report.<\/em><\/figcaption><\/figure>\n\n\n\n

Attackers <3 Your APIs\u2026 And This Can Impact Your Reputation & Bottom Line<\/h3>\n\n\n\n

Your authentication APIs are incredibly attractive targets for cybercriminals that increase your organization\u2019s attack surface. More than two in five bot-based ATO attacks targeted application programming interfaces \u2014 likely because of the juicy data they provide access to. And a huge concern regarding API attacks relates to the use of automation.<\/p>\n\n\n\n

Imperva\u2019s data indicates that automation was used in 30% of the API attacks they analyzed in 2023. Automated attacks can be used for everything from brute force and credential stuffing attacks to DDoS attacks that overwhelm your API, disrupting services and impeding your legitimate customers.<\/p>\n\n\n\n

DDoS Attacks Can Take a Hefty Chunk Out of Your Bottom Line<\/h3>\n\n\n\n

Data from Radware<\/a> indicates that a distributed denial of service (DDoS) attack costs an average of $6,130 per minute as of August 2023. Now, consider that Zayo Group<\/a> estimates the average DDoS attack lasted 68 minutes in 2023. This means that the average company forked over an average of $416,840 in DDoS-related costs that otherwise could have stayed in their bank accounts.<\/p>\n\n\n\n

Now, imagine if a DDoS attack on your business lasted 24 hours. Based on that per-minute estimate, it would mean $8.8+ million in potential DDoS-related costs.<\/p>\n\n\n\n

Consumers Increasingly Hold Businesses Accountable For Security Issues<\/h3>\n\n\n\n

According to Sift\u2019s Q3 2023 Digital Trust & Safety Index data<\/a>, 73% of consumers say that businesses are accountable for credential compromises stemming from ATO attacks. What makes matters worse for those organizations is that three in four of those customers indicate they\u2019d never again do business with ATO-sullied brands.<\/p>\n\n\n\n

So, knowing all of this bad bot data\u2026 what can you do to protect your business?<\/p>\n\n\n\n

How to Battle Bad Bots: A 2-Pronged Approach<\/h2>\n\n\n\n

Bots are automated software programs that are designed to mimic human behaviors and actions. Unlike human hackers, bots are automated systems that virtually never stop. They don\u2019t need to eat, they don\u2019t need to sleep, and they never get bored.<\/p>\n\n\n\n

However, there are things you can do to harden your organization and digital assets against automated attackers without impeding \u201cgood\u201d bots. We\u2019ll explore two primary approaches you can take to mitigate the risks of bad bots to your business.<\/p>\n\n\n\n

1. Manage and Block Bad Bots From the Get-Go Using the Right Tools<\/h3>\n\n\n\n

Use Device, Network, and Website Monitoring & Analysis Tools<\/h4>\n\n\n\n

Robust firewalls<\/a> can help you keep a close eye on your network and website traffic. It\u2019s a good indicator that you have some potentially malicious bot-related activity if you notice any or all of the following:<\/p>\n\n\n\n