Imperva released its April Hacker Intelligence Report Automation of Attacks, which analyzes how and why attacks on Web applications are automated.


As much as 98 percent of Remote File Inclusion (RFI) attacks are automated, and as much as 88 percent of SQL injection attacks are automated, including by two software tools: Havij and sqlmap, say the results of Imperva's April Hacker Intelligence Report which focuses on the automation of attacks.

Automatic tools generally enable hackers to attack more applications and exploit vulnerabilities more efficiently than manual methods, and as they are available online, they save hackers the trouble of studying vulnerabilities and learning how to exploit them.

"Using automated software tools, even an unskilled attacker can attack applications in a short period of time, potentially collect valuable data and move on to the next target," points out Amichai Shulman, CTO, Imperva. "Automated tools can be used to evade an enterprise's security defenses."

"For example, such a tool can periodically change the HTTP User Agent header that is usually sent in each request to an application and that may be used to identify and block malicious clients. As another example, sophisticated automatic tools can split the attack between several controlled hosts, thus evading being blacklisted," states the report.

Traffic characteristics, such as attack rate, attack rate change and attack volume, can be used to identify automated attacks. Also, automated tools can leave 'fingerprints' or patterns that can be extracted from the source code to identify an automated attack with high certainty.

According to Imperva, contending with automated attacks requires:

Rate-based detection mechanisms: Automated tools often interact with sites at inhuman speeds. Signatures, however, are usually confined to single event. The ability to detect inhuman interactions is a key step.

Identification of missing or unique headers: Signatures are good at detecting existing pattern not in detecting missing pieces. Automated tools often lack headers, divulging their ulterior intentions. But malicious automation can be distinguished by its use of unique headers or payloads.

Identification by using the experience of others (reputation): Automated attacks sources tend to attack many targets.

In the report, the company provides analysis of multiple real-world attack vectors, highlighting characteristics security professionals can use to define malicious traffic, enabling black lists of suspected IP addresses.