Internet & SaaS: confronting a surge of sophisticated app & API attacks

In a word, volume. The sheer number of attacks. Take scraping, for example — it’s the most common threat we see. Why? Because it’s an easy value proposition for adversaries: attacks that are inexpensive to launch at scale but burn companies for millions. Scraping is so profitable that questionable businesses dedicated to it are popping up — call them “scraping-as-a-service.”

But beyond scraping, other forms of attack rob internet and SaaS companies (and their customers) of a priceless commodity: time. Simply put, adversaries excel at making things difficult for human users, and put great strain on invaluable relationships in the process. Here’s a closer look at attackers’ mischief:

• Scraping, where bots harvest product data, manipulate prices, or launch denial-of-service attacks. The results: disrupted sales and lost revenue.

• Account takeover, where customer accounts are stolen using techniques such as credential stuffing. Stolen accounts are sold on the Internet, Telegram and other forums resulting in unauthorized user access and acts of fraud.

• Damaging brand reputation by spamming customers, spreading misinformation, or launching phishing attacks. These threats target your fan base, eroding customer trust, affinity, and loyalty.

• Slowing down your site and sullying the user experience. When bots overwhelm your site, they make it difficult for customers to access webpages and lengthen page-load times to the point of exhausting people’s patience.

You’ll notice the damage from multiple angles — particularly in terms of user experience and site performance. More specifically:

• Watch for high numbers of failed login or password reset requests, and listen out for upticks of reports to fraudulent claims to customer support. These are the hallmarks of account takeovers and creations — bogus attempts by bots to pass as real users.

• Are other sites displaying your products and content immediately after you publish them? Are competitors instantly undercutting your prices? Has your search ranking dropped? Yes? Then you’ve got a scraping problem.

• Check your bandwidth. If it’s flooded by unwanted traffic and exhausting your infrastructure, automation is likely at work — which can even cause your entire site to crash.

The greatest danger, though? The combined and compounding toll these problems have on your brand. Tarnished reputation. Eroded equity. Broken customer relationships.

First, a sobering fact: Many traditional bot management tools have given up trying to fight scrapers — they simply can’t keep up. Meanwhile, other tools use faulty challenges like CAPTCHAs or behavioral data (mouse movements or clicks) that rely on JavaScript to load with pages before the solution can work. Too late. The page has loaded, the battle is lost.

Kasada, meanwhile, assumes all requests are guilty until proven innocent, and uses telemetry data, threat intelligence, and behavioral data to accurately detect malicious automation before it enters your site. Plus, Kasada remains effective over time with dynamic defenses and obfuscations, providing protection that lasts. The results speak for themselves:

• Flybuys, Australia’s largest loyalty program, needed greater visibility into its traffic — not only to prevent bots from overwhelming human users and launching application denial-of-service attacks, but to set more accurate KPIs, optimize marketing returns, increase sales, and protect their brand reputation and shareholder value. Kasada does more than just beat bots; we boost business outcomes.

• An American media company found itself paying up to $50,000 per day in infrastructure costs — because of fake account attacks and requests. Kasada helped the company save $2 million over the course of a year and eliminated a particularly pesky problem: Prior to Kasada, 99% of logins were fake, fraudulently boosting certain users’ popularity and increasing payments they appeared to be owed.

• A globally renowned Internet company was suffering fraudulent losses of $700,000 per month. The culprit? Account takeover. Adversaries were hijacking accounts and selling the assets within, or purchasing services to commit further fraud. Enter Kasada, which quickly reduced fraud to a record low.

“From the moment we switched on Kasada, there was immediate feedback on the number of page requests that were bot-driven, and I can tell you Kasada neutralized them from the very first page load request. When a bot attempts to attack us, it ends quite quickly."

Phil Hawkins
Chief Operating Officer, Flybuys