Cybercriminals target e-commerce sites over holiday season

By Joanna England
Online shopping portals are being flooded with millions of ‘bad bots’ over the festive shopping season, experts warn...

Christmas online shopping is under attack from cybercriminals who are using ‘bad bot personas’ that are exploiting vulnerabilities in thousands of e-commerce sites.

According to Barracuda Networks, an email and cloud security company headquartered in California, widespread distributed denial of service (DDoS) attacks are being run from thousands of distinct IP addresses, making fraudulent purchases and exploiting vulnerabilities on online retail portals.

Barracuda networks revealed the breaches in their most recent analysis report Threat Spotlight, which highlighted the dangers facing vendors and shoppers over the Christmas season. 

The opportunities for cybercrime have increased exponentially following the global pandemic that has seen millions of retail outlets globally focus heavily on their online sales to survive. 

Christmas is the biggest shopping season in the UK and due to the tier system, most retail activity will be almost entirely online this year. The Barracuda Advanced Bot Protection solution ran a test web application, and observed that it had been targeted by over 90 million bad bot personas from over 340,000 distinct IP addresses, in just a few weeks.

Bad bot numbers

The data gathered by Barracuda researchers indicates 72% of bad bot traffic belonged to unspecified malicious users, 5% belonged to HeadlessChrome personas, and there was an increase in yerbasoftware and M12bot personas.

The researchers also observed that UK bot activity peaks mid-morning and doesn't fall off until closer to 5pm, which suggests that the cybercriminals (aka 'bot herders') follow a regular working day.

Brett Wolmarans, Director of Application Security Engineering for Barracuda Networks, said, "The holiday shopping season this year will be like no other. E-Commerce teams must ensure they carry out the necessary precautions to safeguard their applications against bad bots.

He added, “This includes installing a web application firewall, or ‘WAF-as-a-Service solution’, and making sure it is properly configured. Teams must also ensure application security solutions include anti-bot protection so they can effectively detect advanced automated attacks, and ‘credential stuffing protection’ should be enabled to prevent account takeover.”


Featured Articles

The top IoT and edge computing trends to watch in 2023

The rise of IoT and edge has driven a wealth of new data-driven technologies, which are set to transform industries and operations across the globe

Top 10 influencers in mobile DE&I for 2023

As the industry works towards reducing the gender gap and tackling the talent shortage, we explore the top 10 female mobile DE&I influencers

BT Group and SPL deliver stratosphere connectivity solution

BT Group and Stratospheric Platforms’ new partnership will see the telecoms leaders collaborate on a new stratosphere connectivity solution for rural areas

Accenture’s insights into the cloud continuum

Technology & AI

82% of business leaders say IoT is critical to improving ESG

5G & IOT

RootMetrics names EE best UK network for the 19th time

Wireless Networks