Predicting online electronic attacks based on other attacks
An indication is received that a first online platform has undergone/is undergoing a first electronic attack made by one or more actors engaged in online malicious actions with the first online platform. Responsive to the indication of the first electronic attack, one or more vulnerability characteristics of the first online platform are determined, where the vulnerability characteristics are associated with the first electronic attack. A plurality of other online platforms are analyzed to identify a second online platform that shares at least one of the vulnerability characteristics with the first online platform. Based on the determining and/or the analyzing, the second online platform is predicted to be a potential target for a second electronic attack having an attack vector in common with the first electronic attack that corresponds to the shared vulnerability characteristics. An action is performed to mitigate potential damage of the second electronic attack.
1 . A method, comprising:
accessing first information corresponding to one or more first electronic attacks perpetrated by one or more malicious actors against one or more first online entities;
extracting, based on analyzing the first information, one or more characteristics of the one or more first online entities, the one or more characteristics allowing the one or more first online entities to be attacked electronically;
accessing second information associated with one or more second online entities;
identifying, based at least in part on the second information, at least a subset of the one or more second online entities that possess the one or more characteristics, wherein the one or more characteristics comprise: a specified software package supported by the one or more first online entities and the one or more second online entities, or a tolerance of an inconsistency between a shipping address and a billing address by the one or more first online entities and the one or more second online entities; and
performing one or more actions that are directed to preventing, mitigating, or remediating one or more second electronic attacks against the subset of the one or more second online entities, wherein the one or more second electronic attacks are the same type of electronic attacks as the one or more first electronic attacks.
2 . The method of claim 1 , wherein the one or more first electronic attacks comprise a carding attack or a credential stuffing attack.
3 . The method of claim 1 , wherein the first information comprises an indication that one or more virtual machines were used by the one or more malicious actors to perpetrate the one or more first electronic attacks.
4 . The method of claim 1 , wherein the second information comprises a search engine query distance between a particular one of the one or more first online entities and a particular one of the one or more second online entities.
5 . The method of claim 1 , wherein:
the analyzing the first information comprises electronically scanning a source code of one or more first websites of the one or more first online entities;
the accessing the second information comprises electronically scanning a source code of one or more second websites of the one or more second online entities; and
the identifying comprises identifying similarities in the source code of the one or more first websites and the source code of the one or more second websites.
6 . The method of claim 5 , wherein the similarities comprise one or more Uniform Resource Locator (URL) links.
7 . The method of claim 5 , wherein the similarities comprise a presence or an absence of one or more anti-fraud mechanisms.
8 . The method of claim 1 , wherein the one or more characteristics comprise a category of goods or services offered for sale by the one or more first online entities and the one or more second online entities.
9 . The method of claim 1 , wherein the one or more characteristics comprise a type of payment accepted by the one or more first online entities and the one or more second online entities.
10 . The method of claim 1 , wherein the one or more actions comprise a temporary denial of one or more electronic transactions involving the one or more second online entities.
11 . The method of claim 1 , wherein the one or more actions comprise transmitting a notification to the one or more second online entities regarding a potential occurrence of the one or more second electronic attacks.
12 . A system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
analyzing first information corresponding to one or more previous electronic attacks perpetrated by one or more malicious entities against one or more first online entities;
detecting, based on the analyzing the first information, one or more online vulnerabilities of the one or more first online entities;
analyzing second information associated with one or more second online entities that have not been subjected to the one or more previous electronic attacks;
determining a search engine query distance between a particular one of the one or more first online entities and a particular one of the one or more second online entities;
identifying, based on the analyzing the second information and at least in part on the search engine query distance, that at least a subset of the one or more second online entities share some of the one or more online vulnerabilities of the one or more first online entities;
determining, based on the identifying, that the subset of the one or more second online entities are vulnerable to one or more future electronic attacks from the one or more malicious entities; and
performing a preventative action or a remedial action directed to the future electronic attacks.
13 . The system of claim 12 , wherein:
the first information comprises source code information of one or more first websites of the one or more first online entities;
the second information comprises source code information of one or more second websites of the one or more second online entities; and
the one or more online vulnerabilities comprise an absence of a first security protection mechanism on both the first websites and the second websites, a presence of a second security protection mechanism having a specified security loophole on both the first websites and the second websites, or a presence of one or more Uniform Resource Locator (URL) links on both the first websites and the second websites.
14 . The system of claim 12 , wherein the one or more online vulnerabilities comprise a category of goods or services offered for sale by both the one or more first online entities and the one or more second online entities, a type of payment accepted by both the one or more first online entities and the one or more second online entities, a specified software package supported by both the one or more first online entities and the one or more second online entities, or a tolerance of an inconsistency between a shipping address and a billing address by both the one or more first online entities and the one or more second online entities.
15 . The system of claim 12 , wherein:
the first information indicates that the one or more previous electronic attacks were perpetrated by the one or more malicious entities using one or more virtual machines; and
the determining comprises determining that the one or more second online entities are vulnerable to the one or more future electronic attacks via the one or more virtual machines.
16 . A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
accessing first information related to a first type of electronic attack perpetrated by one or more malicious entities against one or more first merchants, wherein the first information comprises information associated with one or more virtual machines used to perpetrate the first type of electronic attack;
identifying, based on the first information, one or more vulnerability characteristics of the one or more first merchants with respect to the first type of electronic attack;
accessing second information associated with one or more second merchants;
determining, based at least in part on a presence of the one or more vulnerability characteristics in the second information, that at least a subset of the one or more second merchants are vulnerable to the first type of electronic attack using the one or more virtual machines and are potential targets of the first type of electronic attack by the one or more malicious entities; and
performing one or more actions directed to addressing the first type of electronic attack targeted toward the one or more second merchants.
17 . The non-transitory machine-readable medium of claim 16 , wherein the first type of electronic attack comprises a carding attack or a credential stuffing attack.
18 . The non-transitory machine-readable medium of claim 16 , wherein the second information comprises a search engine query distance between a particular one of the one or more first merchants and a particular one of the one or more second merchants.
19 . The non-transitory machine-readable medium of claim 16 , wherein the one or more vulnerability characteristics are identified further in part based on a source code of one or more first websites of the one or more first merchants and a source code of one or more second websites of the one or more second merchants.
20 . The non-transitory machine-readable medium of claim 16 , wherein the one or more actions comprise denying one or more electronic transactions involving the one or more second merchants or transmitting a notification to the one or more second merchants regarding a potential occurrence of the first type of electronic attack.