Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/15/2019
02:30 PM
Ting-Fang Yen
Ting-Fang Yen
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Online Fraud: Now a Major Application Layer Security Problem

The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.

Online fraud is a subset of cybercrime that typically takes place at the application layer. Although fraud was commonly associated with scams (for instance, Nigerian fraud), fraudulent transactions, and identity theft in the past, its "potential" has exploded in recent years — thanks to the many new ways to cash in on consumer-facing online services and applications.

Many of these new fraud attacks have already made headlines:

  • Fake reviews and purchases to artificially boost a product or seller's ranking
  • Fake accounts created to take advantage of sign-up promotions/bonuses
  • Fraudulent listings with counterfeit products or attractive prices to lure buyers off the platform into under-the-table (and potentially unsafe) transactions
  • Bots generating artificial clicks, installations, and app engagement
  • Virtual items in online games traded or resold for profit
  • Fraudulent transactions
  • Fraudulent credit card and bank account openings from stolen and/or fake identities.

The list goes on. But unlike other types of cybercrime that "hack" into a network or system by obtaining unauthorized access, these new fraud attacks can be launched by simply registering user accounts and abusing available product features offered by online services and applications. The online services have become a part of the attack platform. For cybercriminals, why pay for bulletproof hosting when you can freely and anonymously put up content on social networks and peer-to-peer marketplaces?

This shift away from specialized attack infrastructure means that blacklists and reputation lists traditionally used for detection are becoming ineffective. Fraudsters no longer need to maintain dedicated servers for hosting malicious content or launching attacks, and they can afford to switch up their operation frequently. In DataVisor's recent Fraud Index Report, the median lifetime of a fraudulent IP address is reported to be only 3.5 days. As long as cybercriminals can access the online services and applications — either through anonymous proxies, peer-to-peer community VPNs, or even directly from their home network — the attack is possible.

Attacking at the Application Layer
Attacking at the application layer gives fraudsters a greater chance of blending in with normal users. It is difficult to tell whether an HTTP connection is generated by a human or a script, just as it is difficult to distinguish between a fake user account and a real one.

The application layer, which supports a variety of communication protocols, interfaces, and access by end users, has the widest attack surface. In addition to the application code, vulnerabilities could also exist in access control and web/mobile APIs. Attacks involving authorized users that have already logged in — such as the fraud attacks that leverage user accounts on consumer-facing online services — are the most difficult to prevent and detect.

Depending on the actions and features available on the online service or application, fraudulent accounts can perform a variety of benign actions to stay under the radar. Many lie in wait for weeks, months, or even years before launching the attack. For example, financial fraudsters open multiple credit cards using synthetic identities and accumulate credit history over time, only to cash out their credit limit and disappear. In another example, we have observed fake accounts created on social network sites becoming active after three years to update their profile information with phishing URLs.

These attacks are challenging to detect even for machine learning models. One aspect of this is due to how models "learn" to identify fraudulent and malicious activities. In many popular machine learning applications, such as image recognition or natural language processing, the labels are well-defined and unambiguous; an image of a chicken shows a chicken, not a duck. By giving many examples of "chicken" to the model, we can have pretty good confidence that it will learn to recognize chickens.

However, there is no single definition of fraud or fraudulent behavior. Thus, when applying machine learning to fraud, the labels are noisier. 

Changing Attack Dynamics
A second challenge is due to the dynamic nature of attacks. Without constraints on dedicated attack infrastructure, fraudsters can adapt their operation in a much faster manner to exploit loopholes in the applications. Relying on historical examples of attacks means that the model is always operating based on outdated information, limiting its effectiveness against future attacks.

To deal with sophisticated, fast-evolving online attacks, a robust solution should incorporate multiple layers of defenses. Adopting a strong authentication system, reviewing all API accesses, and performing automated code testing helps to establish a solid baseline defense. Also, organizations must vet developers and third-party apps, be aware of access given on nonstandard interfaces, and understand the types of attacks happening on your service or application to make an educated choice about the type of solution to implement.

To further address abuse involving authorized users, adopt advanced behavior profiling for a holistic analysis of user activities. Online fraud attacks are often performed at scale, involving hundreds to thousands of fraudulent accounts. These "bot" accounts are likely to exhibit behaviors that are very different from those of normal users. Explore technology solutions that focus on data analytics and uncovering new insights rather than the detection of known, recurring attack patterns alone.

It's no longer enough to keep up with online fraud. In fact, if you are just keeping up, you're already behind.

Related Content:

Ting-Fang Yen is a director of research at DataVisor, a company providing big data security analytics for online services and financial institutions. Her work focuses on network and information security data analysis, where she combines data science with security domain ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Cognitive Bias Can Hamper Security Decisions
Kelly Sheridan, Staff Editor, Dark Reading,  6/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12855
PUBLISHED: 2019-06-16
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
CVE-2013-7472
PUBLISHED: 2019-06-15
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
CVE-2019-12839
PUBLISHED: 2019-06-15
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
CVE-2019-12840
PUBLISHED: 2019-06-15
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVE-2019-12835
PUBLISHED: 2019-06-15
formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.