Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By David Senecal, Principal Product Architect – Fraud and Abuse at Akamai Technologies
As 2024 comes to a close, I reflect on yet another chaotic year in the world of bot management. Bots are used to carry out fraud attacks and abuse on the Internet, including credential stuffing, account opening abuse, carding, scalping, and content scraping. As we rolled out new detections this year, some botnet operators found them too tedious to defeat and moved on to less protected targets. However, the most sophisticated and motivated threat actors persevered and either found vulnerabilities to defeat the detections or new ways to exploit less protected areas of the attack surface. This is all part of the game, and in a way, I’m thankful for the threat actors pointing out the shortcomings of existing detection so that we can fix them and build an overall more robust detection engine. Understanding the threat actor’s attack strategy is key to innovation and defining our detection evolution strategy.
There is a saying that the story repeats itself, and that’s very true in the bot management world. Looking at the past helps us predict what will happen in the future. Every time we created and released new detection methods; bots have adapted to them. This trend will continue simply because the financial reward for threat actors to continue their activity is just too great to give up. As a bot management vendor, we always keep an eye on the evolution of the attack surface and research ways to defend it. We’ve defined our development roadmap for the coming year based on the latest attack strategies seen on top e-commerce, travel, and banking websites. I can already predict how bot operators will react to these changes.
Bots are becoming more complex and are very good at impersonating real browsers, but for the most part, we’re still dealing with sophisticated scripts generating or replaying synthetic fingerprints and telemetry. This year, we made great progress in advancing our detection by developing new techniques to obfuscate the JavaScript used to collect data from the client and included new proof of execution methods to force clients to our JS. The evolution of detection has deterred many, but some have adapted to it. Dear threat actors, we heard you and understood the shortcomings you pointed out and are exploiting. We’re working hard to enhance our JavaScript obfuscation strategy to slow down reverse engineering and make the data collection format less predictable.
Now, as we’re closing the door to botnets using sophisticated scripts, I foresee that some operators will update their botnets with headless browsers. Our current detection is designed to detect the most common headless browser frameworks like Puppeteer or Playwright and stealth mode techniques. However, I expect new stealth mode techniques that allow threat actors to remove all the known breadcrumbs left behind by headless browsers to be introduced. As defenders, we’ll have to keep watching the evolution and innovate in our detection methods to keep up.
In case our headless browser detection is not enough and to make things more interesting, we’re going beyond simply detecting whether requests are coming from a legitimate device and browser. We’re also exploring new techniques to evaluate how users interact with their devices and the website in general. For example, scraping bots are very good at visiting a site’s product pages to collect prices and inventory information but never add any product to the cart, log in to the site, or create an account, which makes it a key differentiator with legitimate users. Also, mouse and touch events from bot activity are generally more sporadic or cleaner than the less regular and chaotic human behavior. These more advanced techniques will expose the botnets and force them to make their behavior more human-like.
This multi-prong detection evolution strategy will give threat actors some headaches when fully released and hardened. Whether this puts bot operators out of business remains to be seen. If the story repeats itself, it’s unlikely that the bot problem will be solved once and for all by the end of 2025, but we’ll certainly try.
##
ABOUT THE AUTHOR
David Sénécal works for Akamai Technologies as a principal product architect and is the author of The Reign of Botnets (2024), published by Wiley.
