Breaking fraud & bot detection solutions
summary
Browser fingerprinting and user behavior tracking run as JavaScript snippets (for example fingerprint.js) and claim to detect bots but rely on signals that are trivially observable or forgeable. The talk shows concrete failures: payloads sent base64 or with a DES key in source, replay and stripping attacks let flows fail open, canvas/audio fingerprinting and event-timestamp vectors are spoofed, mobile SDKs leak IMEI and installed‑app lists while iOS limits signals, and underground tools (e.g. anti detect browser $400) commercially defeat defenses.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:57Bot Detection • Defend against bots trying to automate abuse activities e.g. test credential dumps, scraping etc. • Is this activity from a human or a bot?
- 1:54Fraud Detection • Defend against fraudulent activities e.g. manual ATOs, credit card transactions etc. . Look for anomalies in activity of a given user, given past activity.
- 7:54Inline Deployment
- 8:34Attacker Goal • Conduct fraudulent activity • Automate abuse scripts without getting caught
- 9:08Threat Model • Attacker has full control over the browser • Attacker can craft requests and modify responses according to the responses from the server
- 9:35Cloud Deployment
- 12:49Browser Fingerprinting
- 17:27Anti-Tampering JavaScript Obfuscation • XOR based packed code • Randomize location of JavaScript file to load
- 20:24Stripping Attack
- 20:50Replay Attacks • No check on freshness of payload.
- 21:37Dynamic JS Tokens • A dynamic token is generated, which is derived from the timestamp. • Same logic can be replicated in a script.
- 22:22Headless Browsers • Browser without a GUI, often used for automation and testing . Either render full JS or run JS in a virtual DOM
- 25:23Underground Tool • Anti-Detect $399 in the underground market
- 28:04Architecture • Recompile mobile app with SDK .JS -Native Code
- 31:31Takeaways • Implementation and architectural issues in multiple deployments • Not possible to win the race on web, given no root-of-trust via browsers • State of the world in mobile is better • Getting baseline protection across all flows is extremely hard • Inherent privacy issues
related talks
52mBreaking Fraud and Bot Detection Solutions
37mFraud prevention in the age of online privacy
42mCracking the Code: Decoding Anti-Bot Systems!
23mBot or human? Detecting malicious bots with machine...
14mBrowser Fingerprinting: Stalking With a Personal Touch
50mArchitecture of an Anti-Bot Protection
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies
52mFlying Under the Radar - New Security Evasion Techniques