Brute-Force Botnet Attacks Now Elude Volumetric DetectionDecember 19, 2016
As originally published in DARK Reading
It just became harder to distinguish bot behavior from human behavior
Ask just about anyone the question “What distinguishes an automated (bot) session from a human-driven session?” and you’ll almost always get the same first answer: “Speed.” And no wonder - it’s our first intuition. Computers are just faster.
If you focus the question on credential brute-forcing, then it’s even more intuitive. After all, the whole purpose of a brute-force attack is to cover as many options as possible, in the shortest possible time. Working quickly is just elementary, right?
Well, it turns out that this is not always the case. Most defenders, if not all, are already looking at speed and have created volumetric detections that are nothing more than time-based signatures. And that works, most of the time. But the attackers are getting smarter every day, and changing their attack methods. Suddenly, checking speed is no longer enough.
On the first week of October, we detected a credentials brute-force attack on one of our customers that commenced around 03:30am UTC. The attack, which lasted a few minutes shy of 34 hours, spanned a whopping 366,000 login attempts. Sounds like an easy case - 366K over 34 hours is over 10,000 attempts per hour.
But an easy catch? Not by existing volumetric detections, because the attack did not originate from one single IP address. In fact, we discovered that well over 1,000 different IP addresses participated in this attack. Let’s look at the distribution of attempts:
Of all the participating IP addresses, the vast majority (over 77%) of them appeared up to 10 times only, during the entire attack. While the minority may trigger a volumetric detection, 77% percent of the attacking IP addresses would go unnoticed.
One can argue that counting failed login attempts would come in handy here. And it indeed could, except that many of the brute-force attacks don’t actually enumerate on passwords tirelessly. Instead, they try username/password pairs that were likely obtained from leaked account databases, gathered from other vulnerable and hacked sites. Since many people use the same password in more than one place, there is a good chance that some, if not many, of the login attempts will actually be successful.
For a look at specific distributed attacks observed by our research team, read the full piece in Dark Reading.Back to posts comments powered by Disqus