Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

As More People Return to Travel Sites, So Do Malicious Bots

Attacks against travel-related websites are on the rise as the industry begins to slowly recover from COVID-19, new data shows.

With summer holidays, long weekends, and relaxed restrictions on staying at home, the suffering travel industry is seeing some reemerging signs of life: organic visits to car rental websites have grown by 285% since April 1 after a significant drop in traffic during the COVID-19 shutdown.

But as organic growth returns, so have bots carrying out a variety of attacks, including content and price-scraping, hoarding, and malicious attempts to take over user accounts, aka account takeover (ATO), according to a new report from PerimeterX.

"This increase in users is accompanied by an increase in competitive scraping bot requests," PerimeterX Founder and CTO Ido Safruti said in a blog post, referring to the practice where competitors use bots to grab inventory and pricing information from an ecommerce website.

The data shows that competitive scraping-bot requests almost doubled the week of April 20, spiking the last week of April by 544% — and remaining at that level ever since — with a "dramatic increase" in malicious requests from Asia and Europe.

Car rental sites aren't alone, according to PerimeterX. While lodging websites are only seeing 60% of the organic traffic they saw in early March, malicious activity has remained consistent on those sites throughout the pandemic.

"Malicious traffic on this industry did not slow down during this entire period, and we've seen a steady level of scrapers and account takeover (ATO) attacks hitting these sites," writes Safruti.

And while the airline industry is witnessing only a small recovery compared to rental cars, malicious attacks increased 151% by May, and those sites have remained at that level. The malicious bot attacks on airline websites are still not as high as they were before the pandemic, however.

PerimeterX's Safruti says there's reason to believe some of this activity is driven by a coordinated effort. "Large advanced ATO campaigns are in many cases coordinated among crime organizations/actors, and we see large campaigns operating across multiple sites," he said in an email interview. 

Plus, some of the activity isn't criminal, but is likely "competitive warfare."

"Scraping a site's content or pricing is legal (though may break the terms of use of the site). That means there is a market for scrapers, and companies providing data-scraping services and tools for that, and they are selling it out there," he said.

For site operators looking to get a handle on the issue, Safruti recommends checking their logs for anomalies and increased login/failed login attempts, particularly those that don't result in a completed booking.

"Most site operators are aware of the general issue of bots, but not necessarily to the extent that they're impacting their site," he said.

Related Content

Nicole Ferraro is a freelance writer, editor and storyteller based in New York City. She has worked across b2b and consumer tech media for over a decade, formerly as editor-in-chief of Internet Evolution and UBM's Future Cities; and as editorial director at The Webby Awards. ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
PUBLISHED: 2021-01-15
Docker Desktop Community before on macOS mishandles certificate checking, leading to local privilege escalation.
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...