Mastery of the puppets – advanced bot detection

An under the hood look at Polyform in action.

A critical part of Kasada’s product development and R&D process involves building bots to stress test our platform. This allows us to observe our detection platform and isolate its components as we add and improve new functionality.

Where possible we will take characteristics of attacks in the wild to replicate the real world scenarios. We recently built a bot (nicknamed k2-bot) to specifically test the different layers of our platform.

This was the second iteration of this test. On this occasion we upped the ante and increased the sophistication of our bot.

Our goal was to build a tool that would easily evade static tools such as web application firewalls and basic bot detection vendors. We configured a customised version of puppeteer to control headless chrome over the DevTools protocol. This allowed us to obfuscate and anonymise key elements that can be used by bot detection vendors. We then connected this to a global proxy network and delivered 28 requests /second to our testing application. Each request was a test username/password set which mimicked a credential abuse attack.

K2-bot versus Standard WAF protection

We built our bot to automatically avoid detection of any static WAF configuration. We randomly cycled through user agent strings,distributed the attack across 5-600 nodes, rapidly rotated proxy nodes in short bursts and maintained rate limits below levels able to use controlled without impacting real users.

K-bot detection with WAF: 0-5%

IP reputation ability: low

False positive risk: high

Basically, WAF’s are not capable of defending these attacks. A WAF is a static configuration that is looking for known bad behaviour. Our ‘payload’ was benign: a username/password and our tactics evaded any form of network / request analysis. Any attempt to control this attack with a WAF would result in an unacceptably high number of false positives – denying real users access to their account.

Application fingerprinting

Polyform assumes that all users are guilty until proven innocent. Our application fingerprinting technology is capable of differentiating between human or bot. We use an advanced javascript inspection process to profile the client application. This allows us to easily differentiate between a common browser versus an attack tool such as Puppeteer.

Unsurprisingly, when the application fingerprint was involved we were able to capture 100% of the attack traffic

K-bot detection: 100%

False positive risk: low

Not all bot detection vendors are capable of detecting advanced headless chrome bots. Many DDoS and CDN providers claim to protect against bot but are not able to defend the against sophisticated headless bots. Click here to test your vendor’s ability to detect a headless chrome bot: https://becorbot.kasada.io/

Cryptographic challenge

Kasada’s proof of work allows us to rate limit attacks at their source. No amount of bot customisation can avoid the crippling power of Polyform’s challenge. The beauty of the challenge is it’s simplicity. Polyform automatically increases the sophistication of the challenge as the number of requests over time increases.

in our testing we removed the fingerprinting defence and isolated the challenge to truly understand the mechanisms at play.

K-bot was capable of delivering 100,000 requests an hour, however only 500 requests were successfully sent. Polyform’s cryptographic challenge totally crippled K-bot. Each individual bot node was only able to send a single request before Polyform recognised the attack pattern and bricked the node.

Summary

External analysis of account takeover attacks suggests that 1-2% of attacks are successful. That is, at lease 1 in every 100 sets of stolen credentials will successfully unlock an account. If this is true, by sending 100,000 requests per hour, K-bot would be able to unlock 24,000 accounts a day. Our cryptographic challenge as a standalone technology would reduce this by 99.5% to 12 accounts.

Ultimately the combination of advanced application fingerprinting, the cryptographic challenge and our dynamic detection is able to completely stop the attack in its entirety.

k2-bot analysis

Attack Profile
Attack profile Highly distributed account takeover attack
Attack tool Puppeteer + customisations
Botnet nodes 560
Geographic profile High distributed internationally
Attack Profile

Key metric

WAF only Basic bot detection Kasada
Most CDN bot detection Proof of Work
only
Proof of Work
+ Fingerprint

Successful hits to origin per hour

100,000 100,000 500 0

Detection rate

5% 5% 99.5% 100%

Accounts breached per day

24,000 24,000 12 0

Kasada