The new standard for mobile bot defence

Alan Bavosa at Appdome outlines the precautions organisations need to take to keep their business safe from attacks aimed at mobile channels

 

Mobile apps are now the de facto channel for everything digital, making mobile an increasing target for cyber-threats and malicious bots. The good news is innovative solutions – designed specifically for mobile – are providing mobile brands new methods of protection against these threats. 

 

Malicious bots, often referred to as "bad bots," are automated software programs designed to perform tasks with harmful or deceptive intent, including fraud, data harvesting and financial theft.

 

More troubling, malicious bots are becoming increasingly sophisticated and harder to detect, often mimicking human behaviour or abusing legitimate mobile app activities and workflows. This makes it challenging for conventional security measures to distinguish them from legitimate traffic or users.

 

As such, it’s imperative that organisations implement mobile-specific advanced bot defence solutions. 

 

Limitations of traditional anti-bot solutions

Most organisations use Web Application Firewalls (WAF) as the front-line defence against malicious bots. WAFs are specifically designed to protect web applications by filtering, monitoring and blocking HTTP requests between a web client, a website or backend server.

 

Mobile apps do not behave the same way as websites, and they do not face the same types of threats. Defending against malicious bots for mobile requires a fundamentally different approach than solving for web-based attacks. When it comes to detecting and preventing malicious bots, mobile differs from web in several key areas:   

1. Fingerprinting and networking methods  
2. Attack technologies and threat vectors 
3. Telemetry data required to inspect bot activity 
4. APIs and business logic to access APIs, retrieve and store data  

What today’s WAFs need is telemetry data from the mobile apps themselves to ensure that only legitimate apps and users are cleared to gain access to accounts and back-end services and conduct business as usual. So, let’s take a closer look at the current gaps in each area.

 

Fingerprinting and networking stack differences

Any anti-bot solution must be able to differentiate between legitimate connection requests and malicious ones. To do this in mobile requires using multiple methods that capture device-specific details, app characteristics and session information utilising unique identifiers and sensor data. 

 

It all starts with fingerprinting the endpoint that initiates a connection request. Today’s WAFs are unable to deploy fingerprinting and detection technology inside mobile apps, creating a gap of understanding attacks or manipulations that occur on the mobile app itself.

 

WAF vendors rely on web-based detection methods and have tried to use mobile SDKs, but the telemetry derived rarely goes beyond jailbreak/root or emulator detection, and they are also susceptible to false positives, false negatives and spoofing when it comes to the mobile channel. 

 

Mobile apps face different attacks and threats  

Mobile apps typically face a much larger attack surface than web apps and the threats are much more varied and complex, attacking the device, the mobile app and the network. Unfortunately, WAFs cannot natively detect most common mobile app attacks:  

• Device or OS threats: Rooting/Jailbreaking, emulators / simulators / virtualisation tools (e.g. BlueStacks, Memu, Nox) abusing accessibility services, kernel-based attacks, custom bootloaders, rootkits, root cloaking, Jailbreak/root detection bypass frameworks (e.g. Magisk)
• Application threats: Auto-clickers, code injection, overlay malware, keyloggers, key injection, fake apps/clones, trojans, accessibility malware, dynamic binary instrumentation (Frida), reverse engineering (static and dynamic analysis) 
• Network-based threats: MiTM attacks, fake certificates, SSL pinning bypass, session replay attacks, malicious proxies, fake Wi-Fi, TLS downgrade attacks 

Blended attacks, combining more than one of the vectors above, makes this even worse. For example, bad actors can extract the anti-bot SDK of an unprotected, legitimate mobile app and place it inside the malicious clone of the app to gain access to and compromise back-end servers using a technique called credential stuffing.

 

To achieve this, they often reverse engineer the legitimate mobile app to understand the inner workings of the login flow, and then they use emulators or other virtualisation methods to conduct brute-force login requests against backend APIs using stolen credentials. 

 

Telemetry and threat intelligence differences: mobile vs web

Telemetry for mobile bot attacks requires information from sensors, such as GPS, accelerometer, gyroscope and OS-specific elements, which are not available in web browsers. Telemetry for mobile bots also needs to include information about touch gestures, multi-touch events and other interactions with the device’s touchscreen, none of which are accessible to standalone WAF bot detection solutions.

 

These important blind spots of WAFs need to be addressed, especially because attackers often abuse these legitimate OS or mobile app functionalities to disguise their malicious activity or execute more dangerous actions. 

 

Take the BrasDex and Xenomorph banking trojans as examples, which abuse Android Accessibility Service features to intercept events between the operating system and the app. It then leverages a specialised malware payload called “ATS” or Automated Transfer System, enabling it to enter information into fields inside the mobile app. This allows the trojan to masquerade as the mobile banking user, bypass MFA and complete end-to-end transactions such as money transfers – all without the knowledge or involvement of the user.

 

Detecting such sophisticated and dynamic threats is impossible for WAF anti-bot solutions because they do not have access to the telemetry required to perform this detection. 

 

API and business logic differences between mobile and web

APIs are used for most of the app’s core functions in mobile apps. Unfortunately, many WAF-based solutions are limited to protecting a single API, domain or host. That’s important to protect, but there are so many more APIs that require protection against bots. For example, in a mobile banking app, money transfers, payments and other mission-critical functions will use different APIs.

 

In addition, mobile apps are heavily dependent on APIs between the app and external services, databases or other software components such as payment gateways or social media platforms, as well as connecting hardware features of the device (e.g. GPS, camera). Traditional web-based bot solutions will miss attacks that target these APIs.

 

To overcome these limitations, existing anti-bot solutions attempt to bend their products to address mobile-based threats. Anti-bot SDKs can be used for CAPTCHA or JavaScript challenges, but such methods typically require separate servers to be deployed behind the WAF, creating single points of failure performance bottlenecks and latency. 

 

A different approach for mobile bot defence

With the understanding of the deficiencies of web oriented WAFs, what can be done to bridge these major gaps? To effectively defend against malicious bots in the mobile channel requires a solution built into the mobile app by an automated system that works with the WAF to provide the additional intelligence needed. 

 

Such a solution will address the unique requirements of mobile and can detect and protect against the thousands of attack vectors faced by Android and iOS apps. This eliminates the work required by developers to re-build apps, alter the networking stack, change critical workflows or add time and bloat to their release schedules.

 

Modern mobile anti-bot solutions can also: 

• Provide multiple unique fingerprinting methods to analyse and distinguish between safe and potentially risky mobile applications and connections;
• Detect and defend against the thousands of threat vectors unique to mobile apps, including mobile malware, screen overlays, accessibility service malware, permission abuse, keyloggers and more; and
• Collect real-time threat and attack intelligence at the source from inside the mobile app.  

Compatibility with industry-standard WAFs

The ideal mobile anti-bot solution would also be compatible with existing infrastructure such as web application firewalls (WAFs). In this case, an anti-bot solution that works with any standard WAF, allowing threat and attack information to be sent in an encrypted payload for the WAF to use in its enforcement decisions, along with the choice of performing enforcement decisions at the client-side depending on the nature of the threat.

 

This entails a multi-layered fingerprinting approach that’s easy on compute resources for all protected hosts, including client-side rate limiting for connection requests, mTLS pre-authentication and optional phased payload delivery to inspect connection requests as-you-go and preserve compute on WAF and other resources used for parsing and inspection the anti-bot payload.

 

Self-defending and hassle-free implementation

To be effective, any mobile anti-bot solution must be resistant to tampering, spoofing, fake signals and re-packaging as well as reverse engineering. If not, then the anti-bot solution will be susceptible to being bypassed, disabled or even used as part of an attack itself.

 

Solutions that require SDKs to be implemented, agents to be installed or changes to source code or the networking stack require significant effort from the mobile development team and still cannot achieve the required level of telemetry data or protection.

 

Instead, cyber-security and fraud teams can now use innovative approaches to anti-bot defence that leverage cyber-defence automation, enabling cross-functional teams to build robust mobile bot detection and protection capabilities directly into Android and iOS apps without requiring servers, agents, SDKs or code changes.

 

Moreover, cyber-defence automation systems provide a full audit trail of every build and a way to manage, operationalise and version control security releases on an ongoing basis. 

 

And with integrated real-time threat intelligence, organisations gain visibility into real-time threats and attacks against production mobile apps coupled with a “click-to-build" system that allows them to implement new protections into mobile apps immediately as threats are discovered – all from within the DevOps CI/CD pipeline used by mobile dev teams to build and release apps today – fully automated and at scale.  

 

Adapting WAF strategies

As the mobile channel now dominates, security teams at mobile brands need to adapt their Web Application Firewalls strategies to address the new threat posed by malicious bots in mobile. These bots, designed with harmful intent, have evolved to mimic human behaviour and exploit legitimate mobile app activities, posing a significant challenge to conventional security measures. 

 

Traditional WAFs alone cannot address the unique characteristics and threats faced by mobile apps. Key distinctions between mobile and web environments, including fingerprinting methods, attack vectors, telemetry data, and API utilisation demand a specialised approach to mobile bot defence. Attempting to retrofit existing solutions often leads to suboptimal outcomes, introducing points of failure, performance bottlenecks and defence blind spots. 

 

A successful mobile bot defence strategy requires solutions tailored to the mobile ecosystem. These should integrate seamlessly with existing infrastructure, provide real-time threat intelligence, and offer self-defending capabilities to thwart tampering, reverse engineering and bypass attempts.

 

By adopting innovative approaches that do not necessitate extensive code changes or additional components, organisations can successfully defend their APIs against evolving bot threats effectively.

 

Ultimately, a comprehensive mobile bot defence solution empowers cross-functional teams to proactively safeguard their applications, ensuring continuous protection against emerging threats.

 

By leveraging real-time threat intelligence and a streamlined implementation process, organisations can stay ahead of malicious bots, preserving the integrity and security of their mobile channels.

 

---

 

Alan Bavosa is VP Security Products at Appdome

 

Main image courtesy of iStockPhoto.com