Share to: share facebook share twitter share wa share telegram print page

 

Automated threat

An automated threat is a type of computer security threat to a computer network or web application, characterised by the malicious use of automated tools such as Internet bots.[1] Automated threats are popular on the internet as they can complete large amounts of repetitive tasks with almost no cost to execute.[2]

Threat ontology

The OWASP Automated Threat Handbook provides a threat ontology list for classifying automated threats, which are enumerated below.

Identity Code Name Defining characteristics
OAT-020 Account Aggregation Use by an intermediary application that collects together multiple accounts

and interacts on their behalf

OAT-019 Account Creation Create multiple accounts for subsequent misuse
OAT-003 Ad Fraud False clicks and fraudulent display of web-placed advertisements
OAT-009 CAPTCHA Bypass Solve anti-automation tests
OAT-001 Carding Multiple payment authorisation attempts used to verify the validity of bulk

stolen payment card data

OAT-010 Card Cracking Identify missing start/expiry dates and security codes for stolen payment card

data by trying different values

OAT-012 Cashing Out Buy goods or obtain cash utilising validated stolen payment card or other user

account data

OAT-007 Credential Cracking Identify valid login credentials by trying different values for usernames and/or

passwords

OAT-015 Denial of Service Target resources of the application and database servers, or individual user

accounts, to achieve denial of service (DoS)

OAT-006 Expediting Perform actions to hasten progress of usually slow, tedious or time-consuming

actions

OAT-004 Fingerprinting Elicit information about the supporting software and framework types and

versions

OAT-018 Footprinting Probe and explore application to identify its constituents and properties
OAT-005 Scalping Obtain limited-availability and/or preferred goods/services by unfair methods
OAT-011 Scraping Collect application content and/or other data for use elsewhere
OAT-016 Skewing Repeated link clicks, page requests or form submissions intended to alter some

metric

OAT-013 Sniping Last minute bid or offer for goods or services
OAT-017 Spamming Malicious or questionable information addition that appears in public or

private content, databases or user messages

OAT-002 Token Cracking Mass enumeration of coupon numbers, voucher codes, discount tokens, etc.
OAT-014 Vulnerability Scanning Crawl and fuzz application to identify weaknesses and possible vulnerabilities

References

  1. ^ Watson, Colin (2015-10-26). "OWASP Automated Threat Handbook" (PDF). OWASP. OWASP. Retrieved 2016-09-10.
  2. ^ "Security Insights: Defending Against Automated Threats | SecurityWeek.Com". www.securityweek.com. Retrieved 2016-09-18.
Kembali kehalaman sebelumnya


Index: pl ar de en es fr it arz nl ja pt ceb sv uk vi war zh ru af ast az bg zh-min-nan bn be ca cs cy da et el eo eu fa gl ko hi hr id he ka la lv lt hu mk ms min no nn ce uz kk ro simple sk sl sr sh fi ta tt th tg azb tr ur zh-yue hy my ace als am an hyw ban bjn map-bms ba be-tarask bcl bpy bar bs br cv nv eml hif fo fy ga gd gu hak ha hsb io ig ilo ia ie os is jv kn ht ku ckb ky mrj lb lij li lmo mai mg ml zh-classical mr xmf mzn cdo mn nap new ne frr oc mhr or as pa pnb ps pms nds crh qu sa sah sco sq scn si sd szl su sw tl shn te bug vec vo wa wuu yi yo diq bat-smg zu lad kbd ang smn ab roa-rup frp arc gn av ay bh bi bo bxr cbk-zam co za dag ary se pdc dv dsb myv ext fur gv gag inh ki glk gan guw xal haw rw kbp pam csb kw km kv koi kg gom ks gcr lo lbe ltg lez nia ln jbo lg mt mi tw mwl mdf mnw nqo fj nah na nds-nl nrm nov om pi pag pap pfl pcd krc kaa ksh rm rue sm sat sc trv stq nso sn cu so srn kab roa-tara tet tpi to chr tum tk tyv udm ug vep fiu-vro vls wo xh zea ty ak bm ch ny ee ff got iu ik kl mad cr pih ami pwn pnt dz rmy rn sg st tn ss ti din chy ts kcg ve 
Prefix: a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9