A critical part of Kasada’s product development and R&D process involves building bots to stress test our platform. This allows us to observe our detection platform and isolate its components as we add and improve new functionality.
Where possible we will take characteristics of attacks in the wild to replicate the real world scenarios. We recently built a bot (nicknamed k-bot) to specifically test the different layers of our platform .
Our goal was to build a tool that would easily evade static tools such as web application firewalls. We leveraged a common tool (SentryMBA) and connected it to a global proxy network and delivered 28 requests /second to our testing application. Each request was a dumby username/password set which mimicked an account takeover attack.
K-bot versus Standard WAF protection
We built our bot to automatically avoid detection of any static WAF configuration. We randomly cycled through user agent strings, distributed the attack across 5-600 nodes, rapidly rotated proxy nodes in short bursts and maintained rate limits below levels able to use controlled without impacting real users.
K-bot detection with WAF: 0-5%
IP reputation ability: LOW
False positive risk: HIGH
Basically, WAF’s are not capable of defending these attacks. A WAF is a static configuration that is looking for known bad behaviour. Our ‘payload’ was benign: a username/password and our tactics evaded any form of network / request analysis. Any attempt to control this attack with a WAF would result in an unacceptably high number of false positives – denying real users access to their account.
Unsurprisingly, when the application fingerprint was involved we were able to capture 100% of the attack traffic
K-bot detection: 100%
False positive risk: LOW
Kasada’s proof of work allows us to rate limit attacks at their source. No amount of bot customisation can avoid the crippling power of Polyform’s challenge. The beauty of the challenge is it’s simplicity. Polyform automatically increases the sophistication of the challenge as the number of requests over time increases.
In our testing we removed the fingerprinting defence and isolated the challenge to truly understand the mechanisms at play.
K-bot was capable of delivering 100,000 requests an hour, however only 500 requests were successfully sent. Polyform’s cryptographic challenge totally crippled K-bot. Each individual bot node was only able to send a single request before Polyform recognised the attack pattern and bricked the node.
External analysis of account takeover attacks suggests that 1% of attacks are successful. That is, 1 in every 100 sets of stolen credentials will successfully unlock an account. If this is true, by sending 100,000 requests per hour, K-bot would be able to unlock 24,000 accounts a day. Our cryptographic challenge as a standalone technology would reduce this by 99.5% to 12 accounts.
Ultimately the combination of advanced application fingerprinting, the cryptographic challenge and our dynamic pattern analysis is able to completely stop the attack in its entirety.
|ATTACK PROFILE||HIGHLY DISTRIBUTED ACCOUNT TAKEOVER ATTACK|
|Attack tool||Sentry MBA + customisation plugins|
|Geographic profile||High distributed internationally|
|KEY METRIC||WAF ONLY||KASADA|
|PROOF OF WORK ONLY||PROOF OF WORK + FINGERPRINT|
|Successful hits to origin per hour||100,000||500||0|
|Accounts breached per day||24,000||12||0|