As More People Return to Travel Sites, So Do Malicious BotsAs More People Return to Travel Sites, So Do Malicious Bots
Attacks against travel-related websites are on the rise as the industry begins to slowly recover from COVID-19, new data shows.
July 8, 2020
With summer holidays, long weekends, and relaxed restrictions on staying at home, the suffering travel industry is seeing some reemerging signs of life: organic visits to car rental websites have grown by 285% since April 1 after a significant drop in traffic during the COVID-19 shutdown.
But as organic growth returns, so have bots carrying out a variety of attacks, including content and price-scraping, hoarding, and malicious attempts to take over user accounts, aka account takeover (ATO), according to a new report from PerimeterX.
"This increase in users is accompanied by an increase in competitive scraping bot requests," PerimeterX Founder and CTO Ido Safruti said in a blog post, referring to the practice where competitors use bots to grab inventory and pricing information from an ecommerce website.
The data shows that competitive scraping-bot requests almost doubled the week of April 20, spiking the last week of April by 544% — and remaining at that level ever since — with a "dramatic increase" in malicious requests from Asia and Europe.
Car rental sites aren't alone, according to PerimeterX. While lodging websites are only seeing 60% of the organic traffic they saw in early March, malicious activity has remained consistent on those sites throughout the pandemic.
"Malicious traffic on this industry did not slow down during this entire period, and we've seen a steady level of scrapers and account takeover (ATO) attacks hitting these sites," writes Safruti.
And while the airline industry is witnessing only a small recovery compared to rental cars, malicious attacks increased 151% by May, and those sites have remained at that level. The malicious bot attacks on airline websites are still not as high as they were before the pandemic, however.
PerimeterX's Safruti says there's reason to believe some of this activity is driven by a coordinated effort. "Large advanced ATO campaigns are in many cases coordinated among crime organizations/actors, and we see large campaigns operating across multiple sites," he said in an email interview.
Plus, some of the activity isn't criminal, but is likely "competitive warfare."
For site operators looking to get a handle on the issue, Safruti recommends checking their logs for anomalies and increased login/failed login attempts, particularly those that don't result in a completed booking.
"Most site operators are aware of the general issue of bots, but not necessarily to the extent that they're impacting their site," he said.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
The Burnout Breach: How employee burnout is emerging as the next frontier in cybersecurity
Modernize your Security Operations with Human-Machine Intelligence
Selling Breaches: The Transfer of Enterprise Network Access on Criminal Forums