An under the hood look at Polyform in action

A critical part of Kasada’s product development and R&D process involves building bots to stress test our platform. This allows us to observe our detection platform and isolate its components as we add and improve new functionality.

Where possible we will take characteristics of attacks in the wild to replicate the real world scenarios. We recently built a bot (nicknamed k-bot) to specifically test the different layers of our platform .

Our goal was to build a tool that would easily evade static tools such as web application firewalls. We leveraged a common tool (SentryMBA) and connected it to a global proxy network and delivered 28 requests /second to our testing application. Each request was a dumby username/password set which mimicked an account takeover attack.

K-bot versus Standard WAF protection

We built our bot to automatically avoid detection of any static WAF configuration. We randomly cycled through user agent strings, distributed the attack across 5-600 nodes,  rapidly rotated proxy nodes in short bursts and maintained rate limits below levels able to use controlled without impacting real users.

K-bot detection with WAF: 0-5%

IP reputation ability: LOW

False positive risk: HIGH

Basically, WAF’s are not capable of defending these attacks. A WAF is a static configuration that is looking for known bad behaviour. Our ‘payload’ was benign: a username/password and our tactics evaded any form of network / request analysis. Any attempt to control this attack with a WAF would result in an unacceptably high number of false positives – denying real users access to their account.

Application fingerprinting

Polyform assumes that all users are guilty until proven innocent. Our application fingerprinting technology is capable of differentiating between human or bot. We use an advanced javascript inspection process to profile the client application. This allows us to easily differentiate between a common browser versus an attack tool such as SentryMBA.

Unsurprisingly, when the application fingerprint was involved we were able to capture 100% of the attack traffic

K-bot detection: 100%

False positive risk: LOW

Cryptographic challenge

Kasada’s proof of work allows us to rate limit attacks at their source. No amount of bot customisation can avoid the crippling power of Polyform’s challenge. The beauty of the challenge is it’s simplicity. Polyform automatically increases the sophistication of the challenge as the number of requests over time increases.

In our testing we removed the fingerprinting defence and isolated the challenge to truly understand the mechanisms at play.

K-bot was capable of delivering 100,000 requests an hour, however only 500 requests were successfully sent.  Polyform’s cryptographic challenge totally crippled K-bot. Each individual bot node was only able to send a single request before Polyform recognised the attack pattern and bricked the node.

Summary

External analysis of account takeover attacks suggests that 1% of attacks are successful. That is, 1 in every 100 sets of stolen credentials will successfully unlock an account. If this is true, by sending 100,000 requests per hour, K-bot would be able to unlock 24,000 accounts  a day. Our cryptographic challenge as a standalone technology would reduce this by 99.5% to 12 accounts.

Ultimately the combination of advanced application fingerprinting, the cryptographic challenge and our dynamic pattern analysis is able to completely stop the attack in its entirety.

K-bot Analysis

Attack Profile
Attack Profile Highly distributed account takeover attack
Attack tool Sentry MBA + customisation plugins
Botnet nodes 560
Geographic profile High distributed internationally
Protection Results
Key Metric WAF only Kasada
Proof of Work only Proof of Work + Fingerprint
Successful hits to origin per hour 100,000 500 0
Detection rate 5% 99.5% 100%
Accounts breached per day 24,000 12 0

Kasada