86% of Australia's top websites can't detect bot attacks: Research

86% of Australia's top websites can't detect bot attacks: Research 1

New research shows that the vast majority of Australia’s top 250 websites can’t tell the difference between a human using a web browser and a bot running a script, leaving them vulnerable to so-called credential stuffing attacks.

Researchers from Australian cybersecurity firm Kasada selected the target websites based on their Alexa ranking. They focused on the industries most often targeted by bot attacks: Retail, property, wagering, finance, airlines, utilities, and health insurance.

The researchers then loaded the sites’ login pages in three ways: A regular web browser; a script using curl or Node.js; and an automation tool, Selenium.

Around 86% of the tested websites failed to detect the difference, meaning that an attacker could also load the login page with a credential abuse tool, attempting to log in repeatedly using stolen usernames and passwords.

Coinbase 3

In addition, 90% of the websites failed to detect those automated logins.

Credential stuffing is the one kind of attack where it’s easier for the bad guys to build a return on investment, encouraging them to spend money to evade detection, according to Kasada’s lead field engineer, Nick Rieniets.

“Visibility of activity on that login page is where it all needs to start,” Rieniets told ZDNet.

“Our observation is these credential abuse attacks, in many cases, have been going on for weeks before the organisations realise what’s going on … the attackers are doing a great job of evading detection.”

In and of itself, a login request isn’t malicious traffic, Rieniets explained, but a pattern of failing login attempts is, even if they don’t all come from the same source. But how many failed attempts you allow before blocking the traffic depends on the context.

“It’s difficult for consumer-facing sites to lock down logins, because the more you lock it down, the more support cases you end up creating,” he said.

Kasada’s researchers also found that out of 100 credential abuse bot attacks on their own customers, 90 percent came from within Australian ISP networks.

While 100 is a small sample size, the customers included traditional retailers and more modern e-commerce businesses, online gaming operators, and utilities, and therefore skewed to more high-value targets.

Kasada published its research findings and an action plan for organisations in the report Bits Down Under on Tuesday.

Recommendations for cybersecurity teams are to only allow regular web browsers to access the login page; enforce adherence to request flow patterns; take actions to alter the economics of attacking your site; and visualise the human versus bot activity against your login paths.

For organisations, it was recommended that they establish a regular cadence of reporting on these issues; make sure the necessary security controls are in place; and establish and test a data breach response plan.

These recommendations don’t match some other priority lists for attack mitigations, such as the Australian Signals Directorate (ASD) Essential Eight. But Rieniets says his reference for establishing priorities is the data on notifiable data breaches published by the Office of the Australian Information Commissioner (OAIC).

“Credential abuse, which they call brute force attacks … is actually the third most likely attack type that results in a data breach. For me, that’s pretty significant,” he said.

Credential stuffing is a reasonably new attack type, Rieniets said, at least in terms of the number of organisations having to deal with it for the first time. Chief information security officers (CISOs) both in Kasada’s customer base and elsewhere are telling him that preventing them is a priority.

“If it’s not the number one priority for most CISOs this year, it’s certainly very high up,” he said.

Security Coverage

The Windows 10 security guide: How to safeguard your business

How do you configure Windows 10 PCs to avoid common security problems? There’s no software magic bullet, unfortunately, and the tools are different for small businesses and enterprises. Here’s what to watch out for.

Microsoft discloses security breach that impacted some Outlook accounts

Incident took place after hackers compromised a Microsoft support agent’s account.

Building a data pipeline to defend New York from cyber threats

Responsible for protecting a large, complex and federated network of city systems, NYC Cyber Command built its own, open-source data pipeline.

Windows 10 security: A guide for business leaders

Protecting Windows 10 PCs from common security problems requires ongoing vigilance and effort. This ebook explains what steps to take and what risks you should watch out for.

86% of Australia's top websites can't detect bot attacks: Research 2
blank
About the author

E-Crypto News was developed to assist all cryptocurrency investors in developing profitable cryptocurrency portfolios through the provision of timely and much-needed information. Investments in cryptocurrency require a level of detail, sensitivity, and accuracy that isn’t required in any other market and as such, we’ve developed our databases to help fill in information gaps.

Related Posts

blank

E-Crypto News Executive Interviews


blank

bitcoin
Bitcoin (BTC) $ 38,806.00
ethereum
Ethereum (ETH) $ 2,516.49
tether
Tether (USDT) $ 1.00
binance-coin
Binance Coin (BNB) $ 324.30
cardano
Cardano (ADA) $ 1.30
xrp
XRP (XRP) $ 0.720024
usd-coin
USD Coin (USDC) $ 1.00
dogecoin
Dogecoin (DOGE) $ 0.199673
polkadot
Polkadot (DOT) $ 17.31
binance-usd
Binance USD (BUSD) $ 1.00
USD
EUR
GBP
bitcoinBitcoin (BTC)
$ 38,806.00
ethereumEthereum (ETH)
$ 2,516.49
tetherTether (USDT)
$ 1.00
bitcoin-cashBitcoin Cash (BCH)
$ 533.96
litecoinLitecoin (LTC)
$ 138.89
bitcoinBitcoin (BTC)
32.700,77
ethereumEthereum (ETH)
2.120,58
tetherTether (USDT)
0,842673
bitcoin-cashBitcoin Cash (BCH)
449,95
litecoinLitecoin (LTC)
117,04
bitcoinBitcoin (BTC)
27,907.96
ethereumEthereum (ETH)
1,809.77
tetherTether (USDT)
0.719166
bitcoin-cashBitcoin Cash (BCH)
384.01
litecoinLitecoin (LTC)
99.88

Automated trading with HaasBot Crypto Trading Bots

Crypto Scams

blank
The World’s Most Infamous Crypto Hacks and Scams
July 31, 2021
Cryptocurrency Exchanges
Cryptocurrency Exchanges and the Plague of Scams and Bans
June 29, 2021
blank
What Role Do Cryptocurrencies Play In The Era Of Ransomware Attacks?
June 9, 2021
Crypto Scams On The Rise As Market Enters Bull Cycle
Crypto Scams On The Rise As Market Enters Bull Cycle
December 22, 2020
Harpreet Singh Sahni perpetrated the Plus Gold Union Coin (PGUC) scam
Sydney Concert Promoter Harpreet Sahni Involved In $50M Crypto PGUC Scam
November 2, 2020

Blockchain/Cryptocurrency Questions and Answers

Short-Sell Cryptocurrency
How to Short-Sell Cryptocurrency: A Brief Overview
July 17, 2021
Klaytn
What Is Klaytn (KLAY) And How Does It Work?
July 16, 2021
Cryptocurrencies
Our Crypto Roundup Interview Asks- Do Cryptocurrencies Have a Future?
July 15, 2021
Solana
What Is Solana (SOL) And How Does It Work?
June 26, 2021
blank
What Is Plethori Platform And How Does It Work?
June 12, 2021


CryptoCurrencyUSDChange 1hChange 24hChange 7d
Bitcoin38,702 0.04 % 2.49 % 3.81 %
Ethereum2,516.8 0.75 % 3.13 % 12.85 %
Tether1.000 0.10 % 0.13 % 0.40 %
Binance Coin323.36 0.05 % 3.35 % 6.73 %
Cardano1.300 0.60 % 1.80 % 3.96 %
XRP0.7196 0.35 % 4.63 % 15.32 %
USD Coin1.000 0.02 % 0.02 % 0.72 %
Dogecoin0.1995 0.32 % 3.47 % 3.19 %
Polkadot17.30 0.43 % 5.26 % 24.08 %
Binance USD1.000 0.14 % 0.00 % 0.51 %

bitcoin
Bitcoin (BTC) $ 38,576.00
ethereum
Ethereum (ETH) $ 2,515.34
tether
Tether (USDT) $ 1.00
binance-coin
Binance Coin (BNB) $ 324.29
cardano
Cardano (ADA) $ 1.32
xrp
XRP (XRP) $ 0.719218
usd-coin
USD Coin (USDC) $ 1.00
dogecoin
Dogecoin (DOGE) $ 0.199485
polkadot
Polkadot (DOT) $ 17.50
binance-usd
Binance USD (BUSD) $ 1.00