Blog

<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-MPDT54N"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

Homepage

Together with our partner [Tarantool.io](https://www.tarantool.io/en/) we will hold webinar about improving performance of web applications with in-memory DB. Registration to event [available online](https://www.meetup.com/tarantool-japan/events/284220262) on Meetup.

large_Screen_Shot_2022_02_25_at_19_05_51_b9ec7c52e7.png

medium_Screen_Shot_2022_02_25_at_19_05_51_b9ec7c52e7.png

small_Screen_Shot_2022_02_25_at_19_05_51_b9ec7c52e7.png

thumbnail_Screen_Shot_2022_02_25_at_19_05_51_b9ec7c52e7.png

Screen_Shot_2022_02_25_at_19_05_51_b9ec7c52e7.png

Our partner [Yandex.Toloka](https://toloka.ai/) will present online about using crowdsourcing as an essential mechanism required for search results optimization. If your website has a search result page, and you maintaining your own search engine, this seminar will explain how to increase relevancy and quality metrics. We will hold event together with Machine Learning Tokyo community. Registration to event available [online](https://www.meetup.com/Machine-Learning-Tokyo/events/283497559/).

large_Toloka_Event_Feb_4_2022_703974903d.png

medium_Toloka_Event_Feb_4_2022_703974903d.png

small_Toloka_Event_Feb_4_2022_703974903d.png

thumbnail_Toloka_Event_Feb_4_2022_703974903d.png

Toloka_Event_Feb_4_2022_703974903d.png

About

Services

# Overview

There are plenty of issues, that can stop internet business. In multiple cases organized criminals targeting companies websites and services, with simple goal to disrupt business and perform fraudulent operations. As more your business Internet-oriented as much you're exposing yourself to such kind of attacks. Typical misconception is "my website too small to be targeted". Criminals, especially organized, often using automated attacks to multiply their "revenue". Automated attacks can target services relatively randomly, and impact equally small and big companies. Let's take a look on types of attacks and how to protect your business.

# OWASP Classification

Community of information security engineers supporting open industry classification for web threats. In this post we will mainly focus on "automated" attacks. We will try to group them and propose protection measures. Also this post will start series of detailed explanations for each threat "class". List of threats really long, but we will group them base on possible impact.

Big class of attacks related to simulation of user activities by attacker. In that case attacker orchestrating distributed system (botnet) to perform actions same as normal users will do on your website. But with multiple implications for you, consider that instead of real humans, you will have traffic from bots. Actions can be performed within existing business processes implemented by your service, but because this processes used automatically, you will have no outcome. Simply speaking bots can register accounts, but it will not grow your user base. Bots can purchase, but in the end - without generating revenue. Bots can click on Ad banners, but will never buy advertised product. In the end bots are impacting your budget, and budget of your customers.

* [OAT-019 Account Creation](assets/oats/EN/OAT-019_Account_Creation.html)
* [OAT-003 Ad Fraud](assets/oats/EN/OAT-003_Ad_Fraud.html)
* [OAT-006 Expediting](assets/oats/EN/OAT-006_Expediting.html)
* [OAT-005 Scalping](assets/oats/EN/OAT-005_Scalping.html)
* [OAT-011 Scraping](assets/oats/EN/OAT-011_Scraping.html)
* [OAT-016 Skewing](assets/oats/EN/OAT-016_Skewing.html)
* [OAT-013 Sniping](assets/oats/EN/OAT-013_Sniping.html)

Attacks aimed on compromising service protection measures. These attacks trying to bypass authentication and authorization system, compromise different users credentials to gain control on users accounts. Next step after this collection of user personal data, and steal user assets making operations on behalf of user.
* [OAT-009 CAPTCHA Defeat](assets/oats/EN/OAT-009_CAPTCHA_Defeat.html)
* [OAT-007 Credential Cracking](assets/oats/EN/OAT-007_Credential_Cracking.html)
* [OAT-008 Credential Stuffing](assets/oats/EN/OAT-008_Credential_Stuffing.html)
* [OAT-002 Token Cracking](assets/oats/EN/OAT-002_Token_Cracking.html)

Several threats in that list not actual "threats" by themselves, but more a reconnaissance technics, used by attackers to find weak spot in your application before attack. Collect some information, which can ease future attack on your service, or collect some user data to attack other services (this often can lead to leakage of personal data).
* [OAT-004 Fingerprinting](assets/oats/EN/OAT-004_Fingerprinting.html)
* [OAT-018 Footprinting](assets/oats/EN/OAT-018_Footprinting.html)
* [OAT-014 Vulnerability Scanning](assets/oats/EN/OAT-014_Vulnerability_Scanning.html)
* [OAT-020 Account Aggregation](assets/oats/EN/OAT-020_Account_Aggregation.html)

There actual attacks, aiming do disrupt your business in a first place:
* [OAT-021 Denial of Inventory](assets/oats/EN/OAT-021_Denial_of_Inventory.html)
* [OAT-015 Denial of Service](assets/oats/EN/OAT-015_Denial_of_Service.html)
* [OAT-017 Spamming](assets/oats/EN/OAT-017_Spamming.html)

This attacks, usually, performed with botnets and in most cases characterized by massive amount of similar requests to your service. This requests consuming all capacity of your infrastructure and doesn't allow normal users access your website. Spam attacks are quite special case here, they can keep your web service available for clients, but not usable, and from that point of view spam attacks very close to Denial of Service.

Several attacks aimed not on your service directly, but onto your customers. This is equally painful for business and creates additional risks related to issues with prosecution services and regulators.
* [OAT-010 Card Cracking](assets/oats/EN/OAT-010_Card_Cracking.html)
* [OAT-001 Carding](assets/oats/EN/OAT-001_Carding.html)
* [OAT-012 Cashing Out](assets/oats/EN/OAT-012_Cashing_Out.html)

After introducing that classification, in the next blog post we will talk about protection and mitigation measures.

large_botnet_e2b63043b1.jpeg

medium_botnet_e2b63043b1.jpeg

small_botnet_e2b63043b1.jpeg

thumbnail_botnet_e2b63043b1.jpeg

botnet_e2b63043b1.jpeg

OWASP "Automated threats" Overview

# Academic Introduction
From the OWASP perspective DoS attacks are classified as [OAT-015 Denial of Service](https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-015_Denial_of_Service.html). From the perspective of the information system owner, this is a state of the system, when real users can't connect to it, because system 100% of the time processing requests of malicious users. 

Information system like any complex application has multiple chained components. But abstractly this is some ingress Internet channel, connected to various types of balancing solutions, and frontend servers returning responses to users. DoS attacks (despite classification) can be not fully automated. If for example backend servers have vulnerabilities or specifically heavy requests, attackers can consume all backend resources by certain requests from the browser, made manually. 

On another side, we have DDoS attacks, when rather simple requests, or request sequences, can be delivered from thousands of hosts on the Internet distributed across the globe. These attacks are usually fully automated and aimed to fully consume the internet channels available for service.

# Mitigation Measures
What is the difference between targeted, non-automated DoS attacks, and massive DDoS attacks?

Massive DDoS attacks are performed by IoT devices, home routers, and other semi-embedded systems. Malicious software running on such devices can't produce complicated sequences of HTTP requests and handle user sessions. Unfortunately, these devices can produce a gigantic amount of ingress traffic (up to millions of requests per second, and thousands of gigabits per second).

How bad it is? Many companies of "enterprise" level, can rent internet channels with throughput ~100Gbps. And massive modern botnets can easily consume entire channel capacity. Only a few companies have enough resources to process such an amount of malicious traffic (e.g. Google, Amazon, etc.) For others "to be targeted" by such botnet is equal to "lost access to the website". Basically without huge investments into network architecture and equipment, it's impossible to challenge botnet owners. There are companies, who let you process such volumes of traffic through their networks to "scrub" it. These are well-known giants such as Akamai, Cloudflare, and technology companies like our partner Qrator Labs.

In the next post, we will discuss the complexity of traffic "scrubbing" and different methods offered on market.

Publications

Events