Hospitality industry under siege from botnets

Cyber security defenders face increasing threats from bot-based credential abuse targeting the hospitality industry, a report shows.

Bot-based attacks are also being used for advanced distributed denial of service (DDoS) attacks, according to the Summer 2018 state of the internet/security: web attack report by Akamai Technologies.

The report is based on attack data from across Akamai’s global infrastructure and represents the research of a diverse set of teams throughout the company.

Analysis of current cyber attack trends for the six months from November 2017 to April 2018 reveals the importance of maintaining agility not only by security teams, but also by developers, network operators and service providers in order to mitigate new threats, the report said.

The use of bots to abuse stolen credentials continues to be a major risk for internet-driven businesses, but Akamai’s data revealed that the hospitality industry experiences many more credential abuse attacks than other sectors.

Akamai researchers analysed nearly 112 billion bot requests and 3.9 billion malicious login attempts that targeted sites in this industry. Nearly 40% of the traffic seen across hotel and travel sites is classified as “impersonators of known browsers”, which is a common technique used by cyber fraudsters.

Geographic analysis of attack traffic origination revealed that Russia, China and Indonesia were major sources of credential abuse for the travel industry during the period covered by the report, directing about half of their credential abuse activity at hotels, cruise lines, airlines, and travel sites. Attack traffic origination against the hospitality and travel industry from China and Russia combined was three times the number of attacks originating in the US.

“These countries have historically been large centres for cyber attacks, but the attractiveness of the hospitality industry appears to have made it a significant target for hackers to carry out bot-driven fraud,” said Martin McKeay, senior security advocate at Akamai and senior editor of the report.

While simple volumetric DDoS attacks continued to be the most common method used to attack organisations globally, the report said other techniques have continued to appear. Akamai researchers identified and tracked advanced techniques that show the influence of intelligent, adaptive enemies who change tactics to overcome the defences in their way.

One of the attacks mentioned in the report came from a group that coordinated its attacks over group chats on Steam digital distribution platform and IRC (internet relay chat). Rather than using a botnet of devices infected with malware to follow hacker commands, these attacks were carried out by a group of human volunteers.

Another notable attack overwhelmed the target’s DNS (domain name system) server with bursts lasting several minutes instead of using a sustained attack against the target directly. This added to the difficulty of mitigating the attack because of the sensitivity of DNS servers, which allows outside computers to find them on the internet. The burst system also increased difficulty for defenders by tiring them out over a long period of time.

“Both of these attack types illustrate how attackers are always adapting to new defences to carry out their nefarious activities,” said McKeay. “These attacks, coupled with the record-breaking 1.35Tbps memcached attacks from earlier this year, should serve as a not-so-gentle reminder that the security community can never grow complacent.”

Other key findings of the report include a 16% increase in the number of DDoS attacks recorded since 2017. Researchers identified a 4% increase in reflection-based DDoS attacks since 2017 and a 38% rise in application-layer attacks such as SQL injection or cross-site scripting.

The report also noted that in April 2018, the Dutch National High Tech Crime Unit took down a malicious DDoS-for-hire website with 136,000 users.