Imperva, Inc., has published The State of Security Within eCommerce 2022 report, an analysis by Imperva Threat Research of cyber security threats targeting the retail industry. A range of automated threats - from account takeover, credit card fraud, web scraping, API abuses, Grinch bots, and distributed denial of service (DDoS) attacks - were a persistent challenge for the ecommerce sector, threatening online sales and customer satisfaction. The continued barrage of attacks on retailers’ websites, applications, and APIs throughout the calendar year, and during the peak holiday shopping season, is a continued business risk for the retail industry.
“The holiday shopping season is a critical period for the retail industry, and security threats could undermine retailers’ bottom line again in 2022,” says Lynn Marks, Senior Product Manager, Imperva. “This industry faces a variety of security risks, the majority of which are automated and operate around the clock. Retailers need a unified approach to stop these persistent attacks, one that focuses on the protection of data and is equipped to mitigate attacks quickly without disrupting shoppers.”
An automated adversary: bad bots and online fraud plague retail sites
In the past 12 months, nearly 40 percent of traffic on retailers’ websites didn’t come from a human. Instead, it came from a bot, software applications controlled by operators that run automated tasks, often with malicious intent. In the retail industry, the infamous Grinch bot is notorious for inventory hoarding during the holiday shopping season, scooping up high-demand items and making it challenging for consumers to purchase gifts online.
Some of the key trends identified by Imperva include:
- Of all the traffic on retailers’ websites, nearly one-quarter (23.7 percent) was attributed specifically to bad bots, malicious automation that contributes to online fraud. The proportion of advanced bots - scripts that use the latest evasion techniques to mimic human activity and avoid detection - on retail sites grew over the prior year (from 23.4 percent to 31.1 percent). Advanced bots are a considerable challenge for organizations to stop without the right protection in place.
- In 2021, bot-related attacks on retail sites grew 10 percent in October and grew another 34 percent in November, suggesting that bot operators increase their nefarious efforts around peak holiday shopping periods.
- Account takeover (ATO) is another form of online fraud in which cybercriminals attempt to compromise online accounts by using stolen passwords and usernames. In 2021, 64.1 percent of ATO attacks used an advanced bad bot. Of all login attempts on retail websites, 22.6 percent were malicious, nearly twice the volume of recorded on sites across other industries. Attackers used leaked credentials 94.7 percent of the time in credential stuffing attacks targeting retailers, compared to 69.6 percent of the time in other industries.
API abuses and attacks multiply, creating new challenges for retailers
APIs are the invisible connective tissue that enable applications to share data and invoke digital services. Analysis by Imperva Threat Research finds that traffic from an API accounts for 41.6 percent of all traffic to online retailers’ sites and applications. Of that, 12 percent of traffic directs to endpoints, like a database, where personal data is stored (credentials, identification numbers, etc.). More concerning, 3 - 5 percent of API traffic is directed to undocumented or shadow APIs, endpoints that security teams don’t know exist or no longer protect.
Exposed or vulnerable APIs are a considerable threat for retailers because attackers can use the API as a pathway for exfiltrating customer data and payment information. API abuses are often carried out through automated attacks where a botnet floods the API with unwanted traffic, seeking vulnerable applications and unprotected data. In 2021, API attacks increased by 35 percent between September and October, and then spiked another 22 percent in November on top of the previous months’ elevated attack levels. This finding suggests that bad actors scale their efforts around the holiday shopping season as more data is exchanged between APIs and applications that power ecommerce services.
DDoS attacks continue to threaten retailers
A distributed denial of service (DDoS) attack is an automated threat that attempts to disrupt critical business operations by flooding the network or application infrastructure with malicious traffic. The attacks are often launched by a botnet, a group of compromised connected devices that are distributed across the Internet and operated by a single party.
Imperva Threat Research finds that DDoS attacks in 2022 are larger and stronger across all industries. The number of incidents recorded that were greater than 100 Gbps doubled, and attacks larger than 500 Gbps/0.5 Tbps increased 287 percent. What’s more, those targeted by an attack are often attacked again within 24 hours. Imperva finds that 55 percent of websites hit by an application-layer DDoS and 80% hit by a network-layer DDoS were attacked multiple times.
A DDoS attack is a nonstop threat for retailers. The downtime caused by a DDoS attack can lead to site disruption, reputational damage, and revenue loss. A DDoS is a critical threat to online retailers that rely on application performance and availability to enable digital storefronts.