More sophisticated bots battle retailers’ e-commerce sites

What this means: The accelerated growth of e-commerce during the pandemic allowed retailers to scale online models quickly, but that speed introduced vulnerabilities in operating online and didn’t give brands the time to work through all potential threats to their business models. The retail industry still hasn’t conquered cybersecurity threats, and with each breach of credit card and personal data, consumers demand more answers from the brands with which they shop. Retailers are ultimately easy targets due to the large scale of information that they collect and transact each day. Mitigating risks is imperative. Last year, Black Friday generated a record $9.12 billion from online shoppers. During the largest sales events, such as Black Friday and Cyber Monday, e-commerce platforms typically face at least five times — and sometimes up to 30 times — more bot attacks than on normal days. A bot is a software application programmed to perform specific tasks as part of another program or to simulate a human. For example, a chatbot is a bot that can engage in conversations with humans. On the other hand, the U.S. generated more bot attacks than nearly three times the number of people on Earth – and 10 times more than China, the second country of origin for the most bot attacks against online retailers and e-commerce platforms, according to a DataDome report. The holiday season for cybercriminals is the biggest opportunity of the year for retail and e-commerce scams, the report found. Analyzing traffic data during the fourth quarter of 2022, DataDome researchers identified and quantified the proliferation of bots and discovered that attackers tend to choose IP addresses/proxies located in the same country as the website they target to appear more human and bypass traditional geo-blocking techniques. Other key findings included: 98% of attacks, numbering in the billions, were from scraping and scalping bots. Considered a gateway automated threat that often leads to more aggressive and damaging attacks, these bots were used to test the availability of products and target the limited infrastructure resources during the busy holiday season. Scalping attacks followed as fraudsters tried to snag as much inventory as possible to resell for profit later. E-commerce bots increased in sophistication with their ability to mimic human behavior and bypass basic security tools. Not all industries were equally targeted, with greater attacks focused on retail, namely clothing, footwear and electronic goods, among others. The largest attack DataDome observed in the fourth quarter of 2022 targeted a large U.S. retailer with approximately 66 million malicious bot requests in less than two hours. Expert opportunists Tactics of bots threatening the e-commerce channel are not only at holiday times. Bot attacks are numerous and impact consumer experience, and in turn, customer loyalty. “Denial of inventory is typically performed by specialized automated programs/shopping bots, which can represent a very significant threat for e-commerce websites, causing not only direct revenue loss, but also long-term and even permanent damage to the targeted business’ reputation,” Antoine Vastel, DataDome’s head of research, told Retail Leader Pro. “Generally speaking, bots can represent a significant volume of traffic and significantly slow down websites as well as applications, which impact user experience.” With the growing number of e-commerce websites and online shopping in general, the threat from bots continues to evolve with various shopping bots available for purchase in the market. These bots can be customized to attack a specific website or even a specific product or service. “Moreover, competitors are also using bots to scrape the price of products in near-real time to adjust their price,” Vastel said. Newer shopping bots have become more sophisticated and are growing smarter in impersonating legitimate human buyers. In that same line, scalping has become mainstream and essentially the norm, as many hope to scalp limited-edition products to make quick money with hot-ticket items. Furthermore, with the use of data becoming essential to establishing a business, many start-ups and established companies have business models that revolve around scraping, aggregating and exposing data through application programming interfaces (APIs), Vastel said. Ultimately, bots affect the consumer experience. Last year’s fiasco with Taylor Swift and Ticketmaster is a prime example of the increasing sophistication of bots and a massive payday threat actors see, Vastel said. “Bots overtook the website, making tickets impossible to secure and severely affected the experience of her fans, even leading to the Senate judiciary hearings on anti-trust issues with Ticketmaster,” he explained. “But this goes beyond the latest sale of a pop sensations’ concert, it happens with sneakers, [graphics processing units] and gaming consoles. Ultimately, this backs consumers into a corner, forcing many to buy these products on the gray market at a higher price, which increases their chance of getting scammed by buying counterfeit products or receiving nothing at all.” Combating bot activity The primary lesson for retailers from DataDome’s report is to ensure their business and customers are secured by adaptive and thorough bot protection that covers all endpoints across their mobile apps, website and APIs. With the proliferation of bots, traditional and legacy techniques, such as CAPATCHAs and geoblockers, are no longer enough to thwart attackers. “Unfortunately, these methods have been addressed by bot developers like the use of residential proxies to bypass rate limiting as well as geoblocking with IPs located in the same countries as websites targeted or CAPTCHA farms to bypass traditional CAPTCHAs,” Vastel said. “That said, using more advanced and specialized approaches can help retailers combat the sophisticated bot activity that has become everyday for many.” Bot and online fraud are expected to continue to snowball this year as well. “If you look at the volume of threats, they are going through the roof, and it's not going to slow down,” Vastel said. For example, this year massive threats from Log4j, which is typically deployed as a software library within an application or Java service, are expected to continue to evolve exploiting critical vulnerabilities of the code because these attacks have the opportunity for high rewards for scammers. Additionally, when it comes to supply chain issues, Vastel is seeing limited stock on products, which is creating a bubble around the price as seen with luxury goods, sneakers and the PlayStation 5, driving more bot and online fraud activity. “Scalping attacks in particular will also continue to worsen, with the ongoing economic environment propelling scalping as a popular way for attackers to make money by leveraging the scarcity of certain products, which I expect to continue in full force in 2023,” Vastel added. While every industry is at risk of online fraud and bot attacks, e-commerce retailers, unfortunately, remain in the front lines of attack. “There’s a lot of money for businesses in e-commerce, particularly when it comes to highly anticipated products or sales events, and that means a lot of money bots can steal – especially when you consider that some of the most sophisticated bots, like sneaker bots, are designed to purchase goods en masse at launch to later resell,” Vastel said. “These bots, and others, are becoming cheaper and easily available to the general population: bots as a service.” What’s next: As retailers look to monetize their first-party data by selling or renting it, data security is critical to ensure that programs like retail media are safe and effective. And, while it’s easier for breaches to occur in digital channels, retailers also need to look at technology within physical stores as additional targets.

Monthly
Subscription

TRIAL
SUBSCRIPTION

ANNUAL
Subscription

Monthly Subscription

TRIAL SUBSCRIPTION

ANNUAL Subscription

Monthly
Subscription

TRIAL
SUBSCRIPTION

ANNUAL
Subscription