Breaking Fraud and Bot Detection Solutions
Explore techniques for breaking fraud and bot detection solutions in this AppSecUSA 2018 conference talk. Delve into browser fingerprinting and user behavior tracking methods employed by most fraud and bot detection systems. Examine the signals collected by JavaScript snippets running in user browsers and understand why these signals can be unreliable. Learn about various attacks against defenses relying on these signals using a realistic threat model. Gain insights from real-world war stories of architectural and implementation flaws discovered in actual deployments. Understand the challenges of bot detection, fraud detection, and inline deployment strategies. Analyze attacker goals and threat models in cloud deployments. Investigate anti-tampering techniques, JavaScript obfuscation, and potential vulnerabilities like stripping and replay attacks. Explore the use of headless browsers and underground tools in bypassing detection. Examine mobile app fingerprinting techniques and architectural considerations. Conclude with key takeaways on implementation issues, limitations of web-based solutions, mobile protection strategies, and inherent privacy concerns in fraud and bot detection systems. Read more