Bots are everywhere these days. They assist with customer service, SEO, and all forms of entertainment. Simply put, “bots” are just programs that automatically execute code based on criteria or interactions.
Some bots these days are getting supercharged with AI, while others are a bit more diabolical in nature. Bot malware has been around for years, but as bots in general improve, so does the malware variety.
Security company Nordsec, Ltd. released their current study that details how bot malware attacks have increased. Over the past five years, 26.6 million usernames and passwords were stolen, including logins to top services such as Google, Microsoft, and Facebook.
This data is stolen and then sold on the dark web. How much is your information worth? A whopping 6 bucks. Yes, the average cost of somebody’s stolen information is a mere $6.
Obviously, this is not good, but how and why is it so bad?
Bot malware can bypass MFA.
Wait, don’t you always say to use MFA? That it makes my accounts secure? Well, yes. You should use MFA. It does make your accounts secure. But it’s not foolproof. If the criminal steals your entire PC user profile, they might be able to bypass the MFA.
Here’s how they do it. Normally when your password gets stolen, the criminal can’t log into your account because you have MFA enabled. However, if they have your configuration information and cookies they can trick the systems into thinking they’re on a device that was already authenticated. That’s what they use the bot malware for – getting your entire user profile.
By the way, it can get worse. If they have your cookies they can access all of your accounts. They might lock up your Netflix account, or maybe they impersonate you on social media attempting to spoof your contacts and steal their info too. Hopefully you don’t have your credit card stored in your browser as well, because that can end really badly.
So what do you do to stay safe?
Think before you act. The simplest advice is to always think about what you are doing at all times. Don’t click links from emails you aren’t sure about. Don’t visit disreputable websites or download files that you are not sure of the source.
Despite just talking about how bot malware can circumvent MFA, you should have MFA on all your accounts. Multi-Factor Authentication is not perfect, but it is still far superior to not having it on, where only your password is needed. You should have those passwords in a password manager as well, keeping all your credentials safer. These are really quick and easy ways to significantly improve your security with little effort.
Of course, you should have antivirus and antimalware installed (and updated). However, cyber threats are not like the old days. Threats aren’t single source. It’s better to have layered security protecting your network perimeter, monitoring your network activity, and protecting your data. There is a lot to discuss here, so if you have any questions feel free to reach out and ask.