Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

As More People Return to Travel Sites, So Do Malicious Bots

Attacks against travel-related websites are on the rise as the industry begins to slowly recover from COVID-19, new data shows.

With summer holidays, long weekends, and relaxed restrictions on staying at home, the suffering travel industry is seeing some reemerging signs of life: organic visits to car rental websites have grown by 285% since April 1 after a significant drop in traffic during the COVID-19 shutdown.

But as organic growth returns, so have bots carrying out a variety of attacks, including content and price-scraping, hoarding, and malicious attempts to take over user accounts, aka account takeover (ATO), according to a new report from PerimeterX.

"This increase in users is accompanied by an increase in competitive scraping bot requests," PerimeterX Founder and CTO Ido Safruti said in a blog post, referring to the practice where competitors use bots to grab inventory and pricing information from an ecommerce website.

The data shows that competitive scraping-bot requests almost doubled the week of April 20, spiking the last week of April by 544% — and remaining at that level ever since — with a "dramatic increase" in malicious requests from Asia and Europe.

Car rental sites aren't alone, according to PerimeterX. While lodging websites are only seeing 60% of the organic traffic they saw in early March, malicious activity has remained consistent on those sites throughout the pandemic.

"Malicious traffic on this industry did not slow down during this entire period, and we've seen a steady level of scrapers and account takeover (ATO) attacks hitting these sites," writes Safruti.

And while the airline industry is witnessing only a small recovery compared to rental cars, malicious attacks increased 151% by May, and those sites have remained at that level. The malicious bot attacks on airline websites are still not as high as they were before the pandemic, however.

PerimeterX's Safruti says there's reason to believe some of this activity is driven by a coordinated effort. "Large advanced ATO campaigns are in many cases coordinated among crime organizations/actors, and we see large campaigns operating across multiple sites," he said in an email interview. 

Plus, some of the activity isn't criminal, but is likely "competitive warfare."

"Scraping a site's content or pricing is legal (though may break the terms of use of the site). That means there is a market for scrapers, and companies providing data-scraping services and tools for that, and they are selling it out there," he said.

For site operators looking to get a handle on the issue, Safruti recommends checking their logs for anomalies and increased login/failed login attempts, particularly those that don't result in a completed booking.

"Most site operators are aware of the general issue of bots, but not necessarily to the extent that they're impacting their site," he said.

Related Content

Nicole Ferraro is a freelance writer, editor and storyteller based in New York City. She has worked across b2b and consumer tech media for over a decade, formerly as editor-in-chief of Internet Evolution and UBM's Future Cities; and as editorial director at The Webby Awards. ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-14
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterp...
PUBLISHED: 2021-04-14
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station (an...
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.50.3, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.53.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions.