Managing and Mitigating Bots

Chapter 9. Account Takeover

This category of automated traffic is focused on trying to gain control over user accounts within your system, which could be control of existing accounts or creation of new accounts. This has overlap with the security threats I have excluded from the definition of automated traffic for the purposes of this discussion, with the difference being that these activities are completed using entirely legitimate processes but to achieve illegitimate aims.

Good or Bad?

The bots identified in this section are all bad. There is no legitimate purpose or anything in the interests of your business that is being achieved by these activities.

Let’s look at some examples of the types of activity undertaken by account takeover bots.

Credential Stuffing/Credential Cracking

The two most common forms of account takeover are variants in attempts to log into existing user accounts.

Credential cracking (also known as brute-force attacks) is trying multiple username and password combinations until a successful combination is discovered. Usually this means using known usernames or email addresses and then combining them with dictionaries of the most commonly used passwords.

Credential stuffing is an alternative approach that involves taking known lists of email and password combinations and seeing if they are also valid for alternative sites. It is a known weakness of many individuals’ approach to security that they will use a common password across multiple systems.

Both ...