TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Good Bots, Bad Bots, and What You Can Do About Both

2019-03-01 · Read original ↗

ATT&CK techniques detected

9 predictions
T1657Financial Theft
87%
"break into gift card accounts looking for credentials ; afterward, they create counterfeit cards and steal the cash value of the card. in the case of credit cards, attackers use bots to test stolen credit card credentials with small transactions ( for example, $ 1. 00 ). upon suc…"
T1584.005Botnet
79%
"direction of an attacker, or bot herder. botnets provide the collective processing power that ’ s essential to pull off large - scale attacks. from a command and control server, the bot herder directs zombies what to do. virtually all computing devices that have been hijacked by …"
T1657Financial Theft
65%
"( up to 1 tbps ) ddos attacks like the initial 2016 mirai attacks on krebs on security, dyn, and ovh, and the 2018 1. 3 tbps attack on github. ( f5 labs reports extensively about the ongoing threat of thingbots ( / content / f5 - labs - v2 / en / labs / articles / threat - intell…"
T1584.005Botnet
59%
"far more sophisticated, launching attacks from hundreds of ip addresses across multiple geographies. also, many companies have customers, partners, and other legitimate traffic coming from specific countries, so it ’ s often impractical to block traffic entirely from a specific l…"
T1583.005Botnet
41%
"prices on items you ’ re searching for. - monitoring bots check on the health ( availability and responsiveness ) of websites. downdetector. com is an example of an independent site that provides real - time status information, including outages, of websites and other kinds of se…"
T1498Network Denial of Service
41%
"direction of an attacker, or bot herder. botnets provide the collective processing power that ’ s essential to pull off large - scale attacks. from a command and control server, the bot herder directs zombies what to do. virtually all computing devices that have been hijacked by …"
T1584.005Botnet
40%
"are often designed to simulate human behavior. depending on whose numbers you trust, it ’ s estimated that bots of all kinds account for 21 % 3 to over 50 % of all internet traffic today : - former wall street security analyst mary meeker says global bot - generated internet traf…"
T1584.005Botnet
35%
"mostly ineffective for detecting bad bots as attacks are often launched from hundreds of different ip addresses to avert suspicion. but reverse lookup is an effective way to identify good bots, such as search engine traffic. these ip addresses can be allowlisted, but remember tha…"
T1583.005Botnet
31%
"are often designed to simulate human behavior. depending on whose numbers you trust, it ’ s estimated that bots of all kinds account for 21 % 3 to over 50 % of all internet traffic today : - former wall street security analyst mary meeker says global bot - generated internet traf…"

Summary

Not all bots are bad, but for those that are, you need a multi-pronged strategy for keeping them off your network.