Who’s behind bad bots?

Bad bots are always hiding in plain sight when you are online. Understanding how to identify bad bots, who is behind them in the first place, and how to implement a bot mitigation system is the key to protecting yourself. 

Bots can be incredibly useful and they are integral to the function of a lot of software and online applications we use. But they can also be manipulated and used in malicious ways, which is why it’s important that you have a clear bot mitigation process in place to protect your computer.

Anybody can come under fire from bad bots and they are used for a number of things. In some cases, they can be used to attack businesses and websites or they may steal sensitive data or copy online content without permission. Individuals can be attacked by bad bots too when people use them to hack into computers or gather personal information. Bad bots can even influence events on a global scale when they are used to spread misinformation. This is a particular problem right now during the COVID-19 pandemic.  

When people think of bot mitigation, they tend to think about ways to prevent bots from getting past their security system. They imagine all of these bots running around and doing their own thing, but they forget that real people are behind the bots in the first place. They don’t just appear out of nowhere, they are created and put to use for a specific purpose. 

There is no single group of people that use bad bots because they are used for a variety of malicious purposes. All kinds of criminals or morally questionable people will use bots for their own personal gain as they are an inexpensive means to leverage automation. These are some of the most common groups that use bad bots.

There were plenty of scammers around before the internet existed. They would call people up on the phone and try to trick them into sending money or sharing personal details. Those same scams still exist, but they are carried out online instead of over the phone. 

Scammers often use chatbots to try to trick unsuspecting people into giving them money or clicking on malicious links. This is especially common on dating apps and although scammers will operate the chat themselves, using chatbots allows them to extend their reach and target lots of people at once. The bots pose as a real person and they can be very convincing, so a lot of people get caught out. Knowing how to spot bots on dating apps is very important if you want to stay safe.

Hackers are another group that use bad bots to carry out their crimes and there are a lot of different ways they can do this. Getting you to click a link and download malware onto your computer gives them an easy way in, and they will often use chatbots for this.

Credential stuffing bots can also be used to repeatedly try known login information on websites to crack into people’s accounts. The bots do this much faster than any human could (as it often requires testing millions of credentials to find those that are reused across websites), so they make it much easier for hackers to succeed and get at your private information. 

Vulnerability scanning bots are designed to scan websites and applications to find any weaknesses in security software. Again, automation is beneficial as it allows for the scanning of hundreds/thousands of known vulnerabilities towards a particular website. This information will then be reported back to the hackers so they have a list of easy targets. 

Bad bots are not just used by hackers that want to steal personal information. They can also be used to interrupt business operations with DDoS attacks and then extort money from companies. A DDoS (distributed denial of service) attack is when a website is overloaded with traffic from bad bots posing as real users, so it crashes. The hackers will then contact the company and demand a ransom before stopping the attack. Other times, hackers can then try other exploits while the business is distracted and their guard is down during a DDoS attack. Bots can also be used to add items to a basket on an ecommerce site, causing real users to get an ‘out of stock’ message when they attempt to order the product. Again, hackers will use this as a way to demand a ransom from businesses. It is crucial that businesses have a bot management system in place to avoid these kinds of attacks.

Although businesses are often the victims of bad bots, some companies do try to use bad bots to take shortcuts. Think about how many spam emails you get every day, for example? Some of these are coming from companies that you gave your email address to and nothing untoward is going on. But what about those companies that randomly contact you out of the blue when you’ve never heard of them before? It’s likely that they are using bots to scan websites and pick up email addresses wherever they find them, so they can bombard those people with spam emails advertising their product. Some businesses will also use bots to post spam on social media comment pages or forums. This is an attempt to take shortcuts and drive more traffic to their website. 

In some instances, companies will engage in click fraud. This is when bad bots are used to repeatedly click on a link, usually a paid ad. Companies use click fraud to target their competitor’s ads and drive up their advertising costs. The hope is that this will cause problems for rival companies and discourage them from using marketing methods like pay-per-click ads.

Website owners may also use click fraud to increase their own advertising revenue. If they display ads on their site and they get paid every time someone clicks on them, it works in their favor if they’re getting a lot of clicks. So, they will use bad bots to inflate the number of clicks they get and earn a lot of money. 

Website owners that want new content but don’t want to put the time and effort into creating it may use bots instead. Web scraping bots are designed to crawl sites and copy content. In some cases, this is done for archiving reasons and the website owner has agreed for their content to be copied. However, it can be malicious and the content that is copied will be posted on somebody else’s site without permission. Bot detection and mitigation are crucial for websites that want to protect their content and make sure that it is not being used without their consent.

Website owners may also use click fraud to increase their own advertising revenue. If they display ads on their site and they get paid every time someone clicks on them, it works in their favor if they’re getting a lot of clicks. So, they will use bad bots to inflate the number of clicks they get and earn a lot of money. 

Website owners that want new content but don’t want to put the time and effort into creating it may use bots instead. Web scraping bots are designed to crawl sites and copy content. In some cases, this is done for archiving reasons and the website owner has agreed for their content to be copied. However, it can be malicious and the content that is copied will be posted on somebody else’s site without permission. Bot detection and mitigation are crucial for websites that want to protect their content and make sure that it is not being used without their consent.

Using bad bots is not a victimless crime and a lot of people are directly affected by it. Businesses can lose a lot of sales if their website is deliberately crashed or their inventory levels are manipulated. In instances where customer data is stolen, a lot of trust is lost and it’s hard for businesses to get those customers back. Advertising spends can also get out of control because of click fraud. Unless businesses have a good bot mitigation system in place, ad bots can cause some serious financial trouble. 

Individuals are also at risk from bad bots because they can have their identity stolen or their credit card details compromised. Although they will be able to get the money back from the bank, in most cases, it can still cause some problems. Bots are also eroding trust in the information that people have access to and that’s a big problem. People are increasingly misinformed by bots online and it’s becoming harder to tell which social media accounts are real and which ones are bots. 

So, whether you are a business or an individual, it’s important to recognize that there are a lot of people creating and using bad bots online. Most of the time, they fly under the radar and you don’t even realize that you are coming into contact with them. But bot detection software can help protect you against these dangers and keep you safe online.

At the end of the day, it’s the people on the other side of the keyboard that are investing time developing stealthy bots and launching automated threats upon businesses. While it’s tempting to focus solely on the technology used to accurately detect bots, it’s insufficient on its own as it is also critical to understand and address the motivation behind the attack – financial or otherwise. To do this, bot detection software should have an effective means to stop adversaries by slowing down their development, iteration, testing and compute cycles  – thereby making the target harder to beat. While also taking the economics away by making attacks too computationally expensive for them to conduct at-scale when using automation. By doing so, attackers will either move on by finding easier targets to generate a profit – or get frustrated enough whereby the work required to successfully conduct an attack outweighs the benefits. Detecting bad bots is one thing – successfully mitigating them so they don’t return is another.

Kasada architecture has been designed with the adversary in-mind. It is designed to frustrate, declieve and strike back to address the underlying motivations behind an attack – in addition to detecting modern bots using a client interrogation process able to detect the immutable evidence of automation whenever bots interact with websites, mobile apps and APIs.