TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Fake Account Creation Bots – Part 4

2023-12-08 · Read original ↗

ATT&CK techniques detected

9 predictions
T1585.002Email Accounts
98%
"of high - quality email addresses. many fake account creation bot controls rely on the assumption that it is difficult or expensive for bots to acquire large numbers of high - quality email addresses. such controls trust that the top email providers like google, microsoft, yahoo,…"
T1585.002Email Accounts
95%
"automatically and dynamically to changing attacker tactics. this is very effective against bot activity from the most basic to the most sophisticated and is able to adapt to changes in bot tactics. it provides good long - term efficacy, and can prevent both the use, and creation,…"
T1585.002Email Accounts
93%
"fake account creation bots – part 4 introduction this is the fourth article in our series on fake account creation bots. the previous articles have introduced these bots, described how they work. and discussed the motivations behind their use. we also covered the negative impact …"
T1585.002Email Accounts
93%
"as fake bot accounts. in the event of a single account being discovered, it is also hard to identify other related accounts or email addresses. this makes username analysis to identify such fake accounts impossible. attackers can also use email address fuzzing. this allows a sing…"
T1585.002Email Accounts
88%
"of 1 to 5, with one being not particularly effective, and 5 being the most effective. email domain filtering email domain filtering involves blocking account creation using email addresses from low reputation domains and temporary email address providers. this increases the cost …"
T1585.002Email Accounts
86%
"to create the account. this increases attacker cost, as they must manage a large number of email accounts. while effective at mitigating the most simple of automated account creation bots, it can be bypassed by using temporary or disposable email addresses. nevertheless, it tends…"
T1585.002Email Accounts
86%
"the cost of implementing and maintaining a complex multi - step account creation process, which are inefficient in the long term, especially given that it ’ s only effective against the least sophisticated bots and attackers. we rate this a 1 on our efficacy scale. reporting by l…"
T1585.002Email Accounts
50%
"domains - avoiding clear and common username patterns - not using the same password for all fake accounts but rather using a password manager or client relationship management ( crm ) style system to manage a database of unique fake accounts and passwords - using stolen legitimat…"
T1584.005Botnet
40%
"device botnets or compromised routers that use real user ip addresses. attackers can also use services like luminati that provide a network of high - quality residential ip addresses, making bots harder to detect using ip reputation and similar approaches. use of phone farms and …"

Summary

The fourth and final part of a series investigating how automation is used to create fake accounts for fraud, disinformation, scams, and account takeover.