Preventio

preventio

When browsing the web, you may occasionally encounter an error message that reads, "504 Gateway Timeout." While it might seem cryptic at first, this error is more common than you think. If you're wondering what it is, why it happens, and how to fix it, this guide has got you covered. What Is a 504 Gateway Timeout Error? A 504 Gateway Timeout Error occurs when a server acting as a gateway or proxy doesn't receive a timely response from an upstream server. In simpler terms, it means the server you're trying to access is taking too long to respond. This error is a part of the HTTP status code family, which communicates the state of your connection to a server. A "504" indicates that the server acting as an intermediary (like a web host or content delivery network) could not complete your request because the upstream server is unresponsive. What Causes a 504 Gateway Timeout Error? Understanding the causes of this error is key to troubleshooting. Here are the most common reasons: 1. Server Overload The upstream server is overwhelmed with traffic or resource demands. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. 2. Poor Server Communication The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. 3. DNS Issues If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. 4. Firewall Restrictions Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. 5. Server Timeout Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. How to Fix a 504 Gateway Timeout Error Fixing this error depends on whether you're a website visitor or the owner of the website. For Website Visitors: Refresh the Page


Sometimes, a temporary issue on the server resolves itself. Refreshing can help.



Check Your Internet Connection


Ensure your connection is stable. Disconnect and reconnect to verify.



Try Another Browser or Device


Use a different browser or device to rule out local issues.



Clear Your Browser Cache


Cached files can sometimes cause errors. Clear your cache and cookies.



Check if the Website Is Down

Use a tool like CheckIfWebsiteDown to confirm if the issue is global. For Website Owners or Administrators: Check Server Logs


Analyze server logs to identify where the communication breakdown occurred.



Restart Your Servers


Restarting the gateway or upstream server may resolve temporary glitches.



Update DNS Records


Ensure your DNS records are updated and correctly configured.



Increase Timeout Limits


Extend timeout periods in your server settings to allow upstream servers more time to respond.



Optimize Server Performance


Use load balancers or upgrade your hosting plan to handle more traffic efficiently.



Disable Firewall or Proxy Blocks


Review firewall rules to ensure legitimate requests aren’t being blocked.



Contact Your Hosting Provider

If the issue persists, reach out to your hosting provider for support. Preventing 504 Gateway Timeout Errors Proactive measures can help prevent future occurrences. Here’s what you can do: Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues.
Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain.
Optimize Your Website: Minimize heavy scripts and ensure faster loading times.
Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Common Variations of the 504 Error Depending on the browser or server, the error message might look different: "HTTP 504 Gateway Timeout"
"504 Error – The server didn't respond in time"
"504 Gateway Timeout – nginx"
"Gateway Timeout Error – Cloudflare" While the phrasing varies, the issue remains the same: delayed communication between servers. When Should You Seek Professional Help? If you've tried the above fixes and still experience the error frequently, it’s time to consult a professional. Persistent 504 errors could indicate underlying server misconfigurations or hardware issues requiring expert attention. For website visitors, if the error persists on multiple devices and browsers, contact the website owner or administrator. Key Takeaways A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe.
Causes range from server overload to DNS misconfigurations.
Fixes include refreshing the page, checking DNS settings, and optimizing server performance.
Regular monitoring and proactive measures can prevent these errors from happening frequently. The 504 Gateway Timeout Error may seem daunting, but with a clear understanding and the right troubleshooting steps, you can resolve it efficiently. Whether you're a visitor encountering the error or a website owner managing traffic, this guide equips you with actionable solutions to tackle the issue. When browsing the web, you may occasionally encounter an error message that reads, "504 Gateway Timeout." While it might seem cryptic at first, this error is more common than you think. If you're wondering what it is, why it happens, and how to fix it, this guide has got you covered. What Is a 504 Gateway Timeout Error? What Is a 504 Gateway Timeout Error? A 504 Gateway Timeout Error occurs when a server acting as a gateway or proxy doesn't receive a timely response from an upstream server. In simpler terms, it means the server you're trying to access is taking too long to respond. This error is a part of the HTTP status code family, which communicates the state of your connection to a server. A "504" indicates that the server acting as an intermediary (like a web host or content delivery network) could not complete your request because the upstream server is unresponsive. What Causes a 504 Gateway Timeout Error? Understanding the causes of this error is key to troubleshooting. Here are the most common reasons: 1. Server Overload The upstream server is overwhelmed with traffic or resource demands. The upstream server is overwhelmed with traffic or resource demands. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. 2. Poor Server Communication The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. 3. DNS Issues If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. 4. Firewall Restrictions Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. 5. Server Timeout Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. How to Fix a 504 Gateway Timeout Error How to Fix a 504 Gateway Timeout Error Fixing this error depends on whether you're a website visitor or the owner of the website. For Website Visitors: For Website Visitors: Refresh the Page


Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Check Your Internet Connection


Ensure your connection is stable. Disconnect and reconnect to verify. Try Another Browser or Device


Use a different browser or device to rule out local issues. Clear Your Browser Cache


Cached files can sometimes cause errors. Clear your cache and cookies. Check if the Website Is Down

Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Refresh the Page Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Refresh the Page Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Check Your Internet Connection Ensure your connection is stable. Disconnect and reconnect to verify. Check Your Internet Connection Ensure your connection is stable. Disconnect and reconnect to verify. Ensure your connection is stable. Disconnect and reconnect to verify. Ensure your connection is stable. Disconnect and reconnect to verify. Try Another Browser or Device Use a different browser or device to rule out local issues. Try Another Browser or Device Use a different browser or device to rule out local issues. Use a different browser or device to rule out local issues. Use a different browser or device to rule out local issues. Clear Your Browser Cache Cached files can sometimes cause errors. Clear your cache and cookies. Clear Your Browser Cache Cached files can sometimes cause errors. Clear your cache and cookies. Cached files can sometimes cause errors. Clear your cache and cookies. Cached files can sometimes cause errors. Clear your cache and cookies. Check if the Website Is Down Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Check if the Website Is Down Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Use a tool like CheckIfWebsiteDown to confirm if the issue is global. CheckIfWebsiteDown For Website Owners or Administrators: For Website Owners or Administrators: Check Server Logs


Analyze server logs to identify where the communication breakdown occurred. Restart Your Servers


Restarting the gateway or upstream server may resolve temporary glitches. Update DNS Records


Ensure your DNS records are updated and correctly configured. Increase Timeout Limits


Extend timeout periods in your server settings to allow upstream servers more time to respond. Optimize Server Performance


Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Disable Firewall or Proxy Blocks


Review firewall rules to ensure legitimate requests aren’t being blocked. Contact Your Hosting Provider

If the issue persists, reach out to your hosting provider for support. Check Server Logs Analyze server logs to identify where the communication breakdown occurred. Check Server Logs Analyze server logs to identify where the communication breakdown occurred. Analyze server logs to identify where the communication breakdown occurred. Analyze server logs to identify where the communication breakdown occurred. Restart Your Servers Restarting the gateway or upstream server may resolve temporary glitches. Restart Your Servers Restarting the gateway or upstream server may resolve temporary glitches. Restarting the gateway or upstream server may resolve temporary glitches. Restarting the gateway or upstream server may resolve temporary glitches. Update DNS Records Ensure your DNS records are updated and correctly configured. Update DNS Records Ensure your DNS records are updated and correctly configured. Ensure your DNS records are updated and correctly configured. Ensure your DNS records are updated and correctly configured. Increase Timeout Limits Extend timeout periods in your server settings to allow upstream servers more time to respond. Increase Timeout Limits Extend timeout periods in your server settings to allow upstream servers more time to respond. Extend timeout periods in your server settings to allow upstream servers more time to respond. Extend timeout periods in your server settings to allow upstream servers more time to respond. Optimize Server Performance Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Optimize Server Performance Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Disable Firewall or Proxy Blocks Review firewall rules to ensure legitimate requests aren’t being blocked. Disable Firewall or Proxy Blocks Review firewall rules to ensure legitimate requests aren’t being blocked. Review firewall rules to ensure legitimate requests aren’t being blocked. Review firewall rules to ensure legitimate requests aren’t being blocked. Contact Your Hosting Provider If the issue persists, reach out to your hosting provider for support. Contact Your Hosting Provider If the issue persists, reach out to your hosting provider for support. If the issue persists, reach out to your hosting provider for support. Preventing 504 Gateway Timeout Errors Preventing 504 Gateway Timeout Errors Proactive measures can help prevent future occurrences. Here’s what you can do: Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues. Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain. Optimize Your Website: Minimize heavy scripts and ensure faster loading times. Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues. Monitor Server Health: Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain. Use a Content Delivery Network (CDN): Optimize Your Website: Minimize heavy scripts and ensure faster loading times. Optimize Your Website: Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Conduct Regular DNS Checks: Common Variations of the 504 Error Common Variations of the 504 Error Depending on the browser or server, the error message might look different: "HTTP 504 Gateway Timeout" "504 Error – The server didn't respond in time" "504 Gateway Timeout – nginx" "Gateway Timeout Error – Cloudflare" "HTTP 504 Gateway Timeout" "HTTP 504 Gateway Timeout" "504 Error – The server didn't respond in time" "504 Error – The server didn't respond in time" "504 Gateway Timeout – nginx" "504 Gateway Timeout – nginx" "Gateway Timeout Error – Cloudflare" "Gateway Timeout Error – Cloudflare" While the phrasing varies, the issue remains the same: delayed communication between servers. When Should You Seek Professional Help? When Should You Seek Professional Help? If you've tried the above fixes and still experience the error frequently, it’s time to consult a professional. Persistent 504 errors could indicate underlying server misconfigurations or hardware issues requiring expert attention. For website visitors, if the error persists on multiple devices and browsers, contact the website owner or administrator. Key Takeaways Key Takeaways A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe. Causes range from server overload to DNS misconfigurations. Fixes include refreshing the page, checking DNS settings, and optimizing server performance. Regular monitoring and proactive measures can prevent these errors from happening frequently. A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe. Causes range from server overload to DNS misconfigurations. Fixes include refreshing the page, checking DNS settings, and optimizing server performance. Regular monitoring and proactive measures can prevent these errors from happening frequently. The 504 Gateway Timeout Error may seem daunting, but with a clear understanding and the right troubleshooting steps, you can resolve it efficiently. Whether you're a visitor encountering the error or a website owner managing traffic, this guide equips you with actionable solutions to tackle the issue.

What Is a 504 Gateway Timeout Error? Causes, Fixes, and Prevention

The good news of the , the European authority for anti-money laundering and countering terrorist financing, in Frankfurt, signals an expected change in the financial industry. is ready to collaborate with its members to ensure the financial crime fight has the means to be successful. establishment of AMLA The EU While this is just the start of more monitoring, AMLA will be operational in 2025, one thing is clear: customer mindsets are shifting towards a greater emphasis on technology and data management in financial crime prevention, according to , CEO of a Swedish regtech company. Gabriella Bussien Trapets, Bussien highlighted the importance of leveraging knowledge providers and in-house development, as well as stressing the need for banks to stay ahead through innovation and technology-driven solutions. Additionally, Bussien discussed the importance of educating customers about Know Your Customer (KYC) processes to avoid misunderstandings and mistrust. The AMLA driving factor The importance of the creation of AMLA is symptomatic of a specific moment.  Why has the EU decided to establish it now? What factors have led to this decision, and why wasn’t it created 10 or 20 years ago? Understanding the timing and rationale behind AMLA’s creation is crucial in grasping its significance in the fight against financial crime. For Bussien, the question arises as to why such measures haven’t been taken earlier. “However, when coordinating actions across multiple countries, there are inherent challenges in fostering willingness to collaborate. It seems that the recognition of the absolute necessity for such collaboration has matured over time. As the global landscape evolves, there’s a growing understanding that addressing financial crime requires a united, collaborative approach,” she said. She stresses the fact that within the EU, for instance, it’s increasingly apparent that ignoring these issues is no longer feasible. Thus, there’s a shift towards acknowledging the need for a comprehensive, collective response. “While debates may persist, it’s encouraging to see a realization emerging that significant action is warranted from both EU institutions and member states to address financial crime from a holistic perspective,” she added. It’s easy to think that this will be a pivotal moment for combating financial crime in Europe, but is it? What is clear is that this EU decision will establish a greater level of consistency and overarching supervision power, creating a more unified approach. From this perspective, added Bussien, it’s about ensuring stability and equality across the board within the EU financial system. This move towards centralized oversight aims to prevent fragmentation and promote a cohesive strategy in combating financial crime. The new financial rap From a customer perspective, there’s a renewed heightened awareness regarding financial institutions and their susceptibility to financial crimes, particularly in newer generations, who are accustomed to stringent KYC protocols and thorough background checks before becoming customers. For Trapets’ CEO, there’s a shift in expectations, akin to the emphasis on sustainability in business dealings. “Customers are increasingly discerning about where their money is invested, conducting extensive research before choosing a financial institution. This trend, observed especially among newer generations, signifies a departure from the past, where switching banks was less common due to digital barriers,” commented Bussien. The ease of digital banking has facilitated this shift, allowing customers to be more flexible in their choices. As a result, there’s a growing emphasis on informed decision-making and conscientious banking practices among consumers, particularly among younger generations. But, as Bussien said, regarding false positives and their impact on customer bank switching, it’s a complex issue. Reports, such as those in the , highlight instances of false positives leading to account closures by banks. “While these closures may occur due to system protocols rather than any illegal activity on the customer’s part, it still can lead to dissatisfaction, especially if one relies heavily on digital banking,” Bussien commented. “It’s crucial for banks to have robust KYC processes in place to minimize false positives and ensure knowledgeable staff capable of making informed decisions.” New York Times It seems clear that customers must understand that KYC questionnaires are linked to behavior analysis monitored by banks. Any inconsistencies between stated intentions and actual actions can prompt alerts. However, for Bussien, it’s equally important for banks to handle these situations delicately. Instead of immediately closing accounts, there should be thorough investigation processes in place to maintain customer satisfaction while upholding regulatory standards. Trust and credibility in the banking system It is debatable if recent news regarding alleged involvement in facilitating transactions for Iranian foreign entities can have significant repercussions on brand reputation and losing trust and credibility among customers and the broader community. “Generally speaking, loyalty to banks has evolved. Previously, people tended to remain loyal to the bank they initially chose, but this sentiment has shifted across generations. Nowadays, loyalty to a single bank is less common, indicating a broader trend of stretched loyalty,” mentioned Bussien. Lloyds Bank and Santander’s Regarding brand reputation, particularly in the financial sector, it’s unclear how much impact allegations of money laundering or similar issues have on customer churn. “While such scandals undoubtedly affect a bank’s image, customer behavior might be more influenced by their personal experiences. For instance, if a bank consistently fails to address fraudulent activities affecting customers, this may prompt individuals to switch banks, regardless of the institution’s involvement in larger-scale misconduct like money laundering,” added the Trapets CEO. In essence, according to the specialist, the triggers for changing banks might differ based on personal experiences with fraud prevention and customer service, as opposed to perceptions of the bank’s involvement in illicit activities. The role of tech in combating financial crime How to weigh the importance of technology in the banking industry’s efforts to combat financial crime? While some banks opt to develop solutions internally, it’s essential to recognize whether technology is truly their forte. Often, partnering with specialized technology providers proves more beneficial, as these entities possess the expertise and agility necessary for continuous innovation and compliance with regulations. Bussien makes it clear: “It’s a matter of weighing the bank’s internal capabilities against the advantages of leveraging external knowledge and resources. In most cases, banks may find it impractical and inefficient to handle such endeavors internally, given the complexities involved. Relying on technology providers ensures ongoing development and maintenance of robust systems tailored to evolving regulatory requirements.” It’s unmistakable that banks must prioritize the structuring and management of their data. Effective technology implementation hinges on having organized, accessible data sets. Without a structured approach to data management, even the most advanced technology solutions may falter. Therefore, alongside technological investments, banks must focus on refining their data infrastructure to maximize the effectiveness of anti-financial crime measures. All of this combined can foster the renewed importance of financial crime prevention in Europe.

The EU's New Anti-Money Laundering Authority and its Crime Prevention Focus

If your application includes fundamental features like login, registration, password reset/recovery, resend confirmation links, and other specific functionalities requiring server requests, it's crucial to implement mechanisms against brute force attacks and the generation of a substantial load on your service. Without such mechanisms, your application may be vulnerable to various threats, including sending an excessive number of emails/OTPs to users, potentially leading to financial and reputational damage. Many lack adequate rate-limiting measures, relying solely on the limitations imposed by their business logic, such as restricting the number of requests based on a payment model. Some applications, however, do incorporate rate limits, particularly for operations like login attempts, registration, and other critical functionalities. These implementations often depend on the X-Forwarded-For header for IP address tracking. web applications To illustrate a simple example, I came up with this code snippet on Flask from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(
    app,
    key_func=get_remote_address,
    storage_uri="memory://",)

def get_ipaddr():
    # Retrieve the client's IP address from the request
    # X-Forwarded-For header is used to handle requests behind a proxy
    ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
    return ip_address

# Rate limit to 5 requests per minute per IP
@limiter.limit("5 per minute")
@app.route('/')
def index():
    ip_address = get_ipaddr()
    return ip_address In the following sections, I'll explain various approaches to testing and attempting to bypass rate limits in your application. To efficiently test your app for this type of vulnerability, automation is a powerful tool. You can achieve this by employing scripts, such as those in Python (as I often do), or using tools like Burp Suite (btw a great tool for testers and cybersecurity professionals). Also, tools like Postman might be used to automate checks relatively easily. Testing Rate Limit Changing IP value in X-Forwarded-For header X-Originating-IP: 127.0.0.1 Use different IP values in every request you send. Use double X-Forwared-For header. X-Forwarded-For:
X-Forwarded-For: 127.0.0.1 Try the same with different headers. X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwared-Host: 127.0.0.1 Change other headers Try changing the user-agent, content-type, accept-language, etc, or cookies, anything that could be used as a user identifier. If there is a rate limit of 3 tries per IP, every three tries, change the IP value of the header (or other headers or params in your requests). Add blank chars in params Try adding to the params you send %00, %0d%0a, %0d, %0a, %09, %0C, %20 For example param1=value1%%0d%0a 
param2=value2%00 For example, if you are requesting OTP for email verification and you only have 3 tries, use the 3 tries for example@email.com
example@email.com%00
example@email.com%0d%0a
And so on Use similar endpoints If you are testing, for example,/API/v1/signup endpoint, then try to perform brute-force to /Signup, /SignUp, /sign-up. Try adding blank chars (from the above) to the original endpoints. Adding extra params to the requested API endpoint If the limit is on the requests of /api/v1/resetpassword endpoint, try brute-forcing it by adding some query params - once the rate limit is reached, try, for example, /api/v1/resetpassword?param1=value1 Logins matter It might be the case that an app has flawed logic - if you log into your account before each attempt/series of attempts, the rate limit is reset for your IP, and you can continue your password brute-force attack. If you are testing a login feature, you can do this in Burp Suit with a Pitchfork attack in the settings (or you can write your own script for this) for each attempt/series of attempts. Here is my example of how I automated a simple check for the X-Forwarded-For header just to get a POW: from random import randint
import requests
import json


url = "https://yourapp.net/api/v1/regconfirm-resend"
data = {
   "email": "yourtest@mail.com"
}

N = 100


def generate_random_ip():
   return '.'.join(
       str(randint(0, 255)) for _ in range(4)
   )


for _ in range(N):
   headers = {
       "Host": "yourapp.net",
       "Content-Type": "application/json",
       "X-Forwarded-For": generate_random_ip()
   }
   response = requests.post(url, headers=headers, data=json.dumps(data))
   print(headers)
   print(f"Status Code: {response.status_code}, Response: {response.text}") Restoring original visitor IPs A possible solution might be the use of Cloudflare and its mechanisms. A detailed explanation can be found here . I will provide only a brief overview of its defense mechanisms. restoring-original-visitor-ips If you use applications that depend on the incoming IP address of the original visitor, a Cloudflare IP address is logged by default. The original visitor IP address appears in an appended HTTP header called CF-Connecting-IP. By following our web server instructions, you can log the original visitor IP address at your origin server. If this HTTP header is not available when requests reach your origin server, check your Transform Rules and Managed Transforms configuration. If Pseudo IPv4 is set to Overwrite Headers - Cloudflare overwrites the existing Cf-Connecting-IP and X-Forwarded-For headers with a pseudo IPv4 address while preserving the real IPv6 address in CF-Connecting-IPv6 header. Remember, when implementing such a defense mechanism, perform thorough testing. This approach might be subsequently applied to the entire cluster and could adversely affect certain functions and microservices where it is unnecessary. In a nutshell, while fixing a security breach, be cautious, as it could potentially impact the entire application. Analyze which part of your system might be affected negatively and test everything before shipping changes to the prod env. NOTE: Also published . here

Defending Your Web App: A Guide to Rate Limiting and Brute Force Attack Prevention

আপনার ওয়েব অ্যাপকে রক্ষা করা: রেট লিমিটিং এবং ব্রুট ফোর্স অ্যাটাক প্রতিরোধের জন্য একটি নির্দেশিকা

Verteidigen Sie Ihre Web-App: Ein Leitfaden zur Ratenbegrenzung und zur Verhinderung von Brute-Force-Angriffen

Defendiendo su aplicación web: una guía para limitar la velocidad y prevenir ataques de fuerza bruta

Défendre votre application Web : un guide sur la limitation du débit et la prévention des attaques par force brute

अपने वेब ऐप का बचाव: दर सीमित करने और क्रूर बल के हमले की रोकथाम के लिए एक गाइड

Web アプリの防御: レート制限とブルート フォース攻撃防止のガイド

웹 앱 방어: 속도 제한 및 무차별 대입 공격 방지 가이드

Defendendo seu aplicativo da Web: um guia para limitação de taxa e prevenção de ataques de força bruta

Защита вашего веб-приложения: руководство по ограничению скорости и предотвращению атак методом перебора

Web Uygulamanızı Koruma: Hız Sınırlama ve Kaba Kuvvet Saldırısını Önleme Kılavuzu

Bảo vệ ứng dụng web của bạn: Hướng dẫn giới hạn tỷ lệ và ngăn chặn tấn công vũ phu

保护您的 Web 应用程序：速率限制和暴力攻击预防指南

Welcome to an insightful conversation with Kennard, the innovative mind behind Sentrii, a groundbreaking tool that's transforming how we safeguard our digital assets in the Web3 universe. Fresh off their victory at the Crypto.com Hackathon, Kennard shares the journey, challenges, and future vision of Sentrii in tackling the ever-evolving landscape of digital scams. Interview with Kennard, Winner of the Crypto.com Hackathon with Sentrii Ishan Pandey: Congratulations on Sentrii's success at the Crypto.com Hackathon! Could you begin by sharing your inspiration behind Sentrii and the journey that led you to address the challenge of preventing digital scams in the Web3 space? We decided to take on the challenge to address digital scams in the Web3 space as several members of our team have fallen victim to phishing scams and signed malicious transactions unknowingly. We found this issue especially widespread, so we wanted to make a material impact to protect ourselves and fellow Web3 adopters. Kennard: Ishan Pandey: Sentrii leverages AI to detect fraud early in Web3 environments. Can you elaborate on how your web extension works and the specific technologies involved in scanning website details, smart contracts, and crypto wallets transaction history? We envision Sentrii to be a wallet plugin, like that of a MetaMask Snap. Some technologies involved would include a Machine Learning model that is able to return how likely a website is malicious, by looking through the URL and the HTML components rendered. To assess the risk of smart contracts, we would leverage on the existing web3 data tools available to scan through the smart contract code and also simulate the transaction in a controlled environment, utilising libraries like honeypot.js. Aggregating all the issues detected, we will then issue a trust score for a clear end user experience. Kennard: Ishan Pandey: The prevalence of 'verified' badge misuse, phishing through "airdrop" campaigns, and scam tokens promoted by Key Opinion Leaders (KOLs) are significant challenges. How does Sentrii specifically address these issues, and what makes your solution effective? Sentrii is agnostic to the source of the scam – whether it be from Key Opinion Leaders, ‘verified’ twitter accounts, or anyone else. What Sentrii does is determine the legitimacy of the website and contracts using AI, given the highly predictable and common features that we managed to find in domains and HTML code of many malicious phishing sites. Kennard: Ishan Pandey: As Web3 continues to evolve, how do you see the role of AI in maintaining security and trust within this ecosystem? And how does Sentrii fit into this future landscape? We believe that phishing scams will be increasingly prevalent to capture even more new adopters of Web3 as it advances. With growing security concerns in the space, AI will be taking on a pivotal role in Web3. We envision the increased implementation of AI in products like ours, which proactively warns users against interacting with suspicious websites. With more data, AI models can also increase their predictive accuracy via adaptive learning. Kennard: Ishan Pandey: Winning the Hackathon is a significant achievement. What are your future plans for Sentrii, and how do you intend to further develop and scale your solution? Crypto.com Winning the hackathon is indeed a significant milestone for Team Sentrii. It's a testament to our commitment and innovative approach towards enhancing security in the Web3 space. Looking forward, we will be working on the further development of our product – such as improving the accuracy and capabilities of our AI model and increasing the user-friendliness of Sentrii. We hope to see our solution being used by the average consumer one day! Kennard: Ishan Pandey: Finally, for our audience who are navigating the Web3 space, what advice would you give them to protect themselves from digital scams, and how can they make the best use of tools like Sentrii? While AI tools like Sentrii can be extremely effective in preventing scams, no AI solution is 100% reliable. We would recommend that all users take the first step in protecting themselves. Using knowledge as the first line of defense, users should stay informed and educated on the latest types of scams in the Web3 space, understand their common signs, as well as practice safe online browsing habits. Also, it is important to always remain skeptical about what they invest in – after all, if something is too good to be true, it probably is. Kennard: Don’t forget to like and share the story! : Vested Interest Disclosure This author is an independent contributor publishing via our . Be it through direct compensation, media partnerships, or networking, the author has a vested interest in the company/ies mentioned in this story. HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYOR brand-as-author program

Sentrii Unveiled: How AI is Shaping the Future of Fraud Prevention in Web3

Sentrii উন্মোচন: কিভাবে AI ওয়েব 3-এ জালিয়াতি প্রতিরোধের ভবিষ্যত গঠন করছে

Sentrii enthüllt: Wie KI die Zukunft der Betrugsprävention in Web3 gestaltet

Sentrii presentado: cómo la IA está dando forma al futuro de la prevención del fraude en Web3

Sentrii dévoilé : comment l'IA façonne l'avenir de la prévention de la fraude dans le Web3

सेंट्री का अनावरण: कैसे एआई वेब3 में धोखाधड़ी की रोकथाम के भविष्य को आकार दे रहा है

Sentrii が明らかに: AI が Web3 における不正行為防止の未来をどのように形作るか

Sentrii 공개: AI가 Web3에서 사기 예방의 미래를 형성하는 방법

Sentrii revelado: como a IA está moldando o futuro da prevenção de fraudes na Web3

Представление Sentrii: как искусственный интеллект формирует будущее предотвращения мошенничества в Web3

Sentrii Açıklandı: Yapay Zeka, Web3'te Dolandırıcılığı Önlemenin Geleceğini Nasıl Şekillendiriyor?

Sentrii tiết lộ: AI đang định hình tương lai của việc ngăn chặn gian lận trong Web3 như thế nào

Sentrii 揭晓：人工智能如何塑造 Web3 欺诈预防的未来

Scientific American, Volume XLIII., No. 25, December 18, 1880, by Various, is part of the HackerNoon Books Series. You can jump to any chapter in this book . HOW TO RAISE TURKEYS. here FIRES—CAUSES AND PREVENTION. It is estimated that the total annual losses of insured property by fire, throughout the world, average nearly two hundred million dollars. Add to this the annual destruction of uninsured property, and we should probably have a total amounting to quite double these figures. How great the loss, how severe the tax upon the productive industry of mankind, this enormous yearly destruction amounts to, will come home to the minds of most readers more directly if we call attention to the fact that it just about equals the value of our total wheat crop during a year of good yield. And it is a direct tax upon productive industry everywhere, because, although here and there a nominal loser, fully insured, has only made what is sometimes called "a good sale" to the companies holding his risk, this is only a way of apportioning the loss whereby the community at large become the sufferers. Thus it is that we find all ably-managed insurance companies earnestly endeavoring to make it plain to the public how fires should be guarded against, or most effectually localized and controlled when once started. During the fall, or from "lighting up" time till about New Year's day, more fires occur ordinarily than in any other portion of the year. This fact points to some of the most general causes of conflagrations—as in the lighting and heating of houses, factories, etc., where this had not been necessary during the summer months. It is also found that after the first of the year the number of fires is greatly diminished, the lighting and heating arrangements having been subjected to a period of trial during which their most obvious defects would be remedied. While it may readily be conceded that the utmost care of the owner of property could not totally prevent great average losses from fire—for the greater the holdings the more must the proprietor trust to the oversight of others—it is evident that the above facts indicate the necessity of more strenuous precautions at this season. Gas pipes and fittings should then be tested; furnace flues and settings looked to; stove, heater, and grate fixtures and connections examined—and in all these particulars the scrutiny should be most closely directed to parts ordinarily covered up or out of sight, so that any defect or weakness from long disuse may be exposed. When to the above causes of fires we have added the extremely fruitful one found in the extensive use of coal oil within a few years past, we have indicated the most common sources of conflagrations of known origin. An English authority gives the percentages of different causes of 30,000 fires in London, from 1833 to 1865, as follows: Candles, 11.07; curtains, 9.71; flues, 7.80; gas, 7.65; sparks, 4.47; stoves, 1.67; children playing, 1.59; matches, 1.41; smoking tobacco, 1.40, other known causes, 19.40; unknown causes, 32.88. The foregoing figures do not give the percentage of incendiary fires,> and later statistics would, no doubt, show vastly more fires from the use of kerosene than are here attributed to candles. The prevention of fires, and the best means of minimizing the loss when they do occur, are topics which cover a wide field, and a collection of the literature on the subject would make a very respectable library. As the question presents itself to-day, it may well be doubted whether the general practice of large property holders of insuring all their possessions does not tend to lessen the constant vigilance which is the most essential requisite in preventing fires. Thousands of merchants never mean to keep a dollar's worth of goods in store or warehouse that is not fully covered by insurance, and they make this cost a regular charge upon their business as peremptorily as they do the wages paid the hands in their employ. But few manufacturers can so completely cover their risks by insurance, yet a large portion of them do so as far as they are able. It does not follow but that the larger portion of both merchants and manufacturers exercise what the law will fully decide is "due vigilance" in the care of the property so insured, but it is evident that in most cases the thoughtfulness is much less complete—the care wonderfully lacking in personal supervision—as compared with what would be the case were each one his own insurer. Of course, this in no way casts a doubt upon the general policy of business men being amply insured, but in fact shows the greater necessity why they should be so, that they may not suffer from the carelessness of a neighbor; it also points to the necessity of continually increasing care and thoroughness of inspection on the part of the insurance companies. These agencies, in fact, must compel the insured to keep up to the mark in the introduction of every improvement to ward off fires or diminish their destructiveness. The progress made in this department during recent years has been great. The almost universal use of steam has been attended by the fitting up of factories with force pumps, hose, and all the appliances of a modern fire brigade; dangerous rooms are metal sheathed, and machinery likely to cause fire is surrounded by stationary pipes from which jets of water may be turned on instantaneously from the outside; stores and warehouses have standing pipes from which every floor may be flooded with water under pressure, and the elevators, those most dangerous flues for rapidly spreading a fire, are either bricked in entirely or supposed to be closed at every floor. The latter point, however, is sometimes forgotten, as sea captains forget to keep the divisions of their vessels having watertight compartments separate from one another; the open elevator enlarges a small fire as rapidly as the open compartment allows the vessel to sink. With the best of appliances, however, discipline and drill on the part of the hands, in all factories, is of prime importance. It is always in the first stages of a fire that thoroughly efficient action is necessary, and here it is worth a thousand-fold more than can be any efforts after a fire is once thoroughly started. Long immunity is apt to beget a feeling of security, and the carelessness resulting from overconfidence has been the means of destroying many valuable factories which were amply provided with every facility for their own preservation. The teachers in some of the public schools of New York and Brooklyn, during the past year, set an example which some of our millowners might profitably follow. There have been cases when, from a sudden alarm of fire, children have been crushed in their crowding to get out of the building. The teachers, in the instances referred to, marched their children out, under discipline, as if there had been a fire. Let owners of factories try some such plan as this, by which workmen may be called upon to> cope with an imaginary fire, and many of them will, we venture to say, find means of improving their present system or appliances for protection, elaborate as they may at present think them to be. About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Various (2007). Scientific American, Volume XLIII., No. 25, December 18, 1880. Urbana, Illinois: Project Gutenberg. Retrieved https://www.gutenberg.org/cache/epub/21081/pg21081-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

FIRES—CAUSES AND PREVENTION

In the digital age, safeguarding business operations from fraud is more complex than meets the eye. It's not just about identifying deceit; it's about protecting brand integrity and customer trust. This demands a shift in focus from traditional metrics like Recall and Precision to a more nuanced approach. This article explores the advanced metrics that help enterprises safeguard their operational integrity and brand reputation. Binary Classification We often solve the binary classification problem when we need to mark objects or events (users, clicks, reviews, ratings, transactions, etc.) as legit or fraudulent. But how do we measure its accuracy? If you ask a random data scientist the two most important metrics for a binary classification task, they will name Recall and Precision. There is a classic matrix (with 1 for fraud and 0 for legitimate) and everyone's favorite metrics: Precision measures the percentage of identified positives that are positive. Recall, on the other hand, measures the rate of actual positives that were correctly identified. The F1-Score measures test accuracy and is a weighted average of Precision and Recall. Sure, these are the most convenient metrics to compare two models on the same dataset, but from a business point of view, I would single out other metrics that need monitoring as part of the anti-fraud task. Class Imbalance The problem is a class imbalance, which occurs when one data category significantly outweighs another in a dataset. For example, in a dataset with a million credit card transactions, if only 100 are fraudulent, there's a significant imbalance in the data. It can lead models to overlook rare but crucial categories like fraud. As a fraud prevention expert, I have dealt with class imbalances in other categories of fraud. Here are some examples: Similar share. It could happen in e-commerce parsing when the number of requests from parsers can be commensurate with the requests of people, which gives us approximately the same balance. Overwhelming fraud activity. These are DDoS attacks where there may be 0.00001% or less traffic from legitimate users during the attack. One of the most significant attacks I've encountered had 21 million requests per second from an attacker. Another example of this imbalance is CAPTCHA services. If you have a good algorithm for determining who to show a CAPTCHA to, then 99.9% of robots and very few people will get it. Minor fraud instances. It is the already mentioned transactional anti-fraud or abuse of promotional codes if there are reasonable product restrictions. It is important to note that fraud can be unstable. There may be situations when there will be little fraud for weeks, and then there will be an unexpected attack, and the balance of classes will shift. Also, there could be system shifts in fraud. Let's say our fraud share is 10%; a year ago, it was 5%. If we previously considered 95% Precision a good value, now, we may need to raise the bar. Precision and Recall Problem Let's explore a real-world example from my experience dealing with DDoS attacks. Imagine an attack scenario where we recorded 1,000,000 requests from bots amidst the usual human traffic of 1,000 requests — indicating a situation where bot traffic was 1,000 times greater than legitimate traffic. Now, imagine having two defense strategies to pick from: The first boasts a Precision of 99.9%. By implementing this algorithm, we blocked all incoming traffic. As a result, our precision stands at 1,000,000 divided by 1,001,000, which is approximately 99.9%. On paper, this looks impressive. However, in practical terms, this algorithm is flawed as it blocks genuine human users as well. In the second approach, we blocked 99.9% of malicious traffic without impacting genuine human traffic. However, this still means that 0.01% of malicious traffic, equating to 10,000 requests, reached our service. This volume is ten times our usual traffic (1,000 requests) and could seriously jeopardize the service's functionality. Product Focus From the business point of view, it is better to look at the True Negative Rate (what share of real users we affect) and the Negative Predictive Rate (what traffic share is good). The former is a good alternative for Precision, while the latter is a viable substitute for Recall. To remind you, the True Negative Rate gauges the accuracy of identifying legitimate transactions as non-fraudulent. It's the percentage of correctly classified legitimate transactions out of all the legitimate transactions. A high True Negative Rate indicates that your system can accurately discern genuine transactions from potential threats, contributing to a more efficient and reliable fraud prevention mechanism. The Negative Predictive Rate measures the accuracy of identifying legitimate transactions. Essentially, it's the percentage of correctly classified legitimate transactions out of all predicted transactions. A high Negative Predictive Rate indicates that when your system predicts a legitimate transaction, it will likely be correct, enhancing the efficacy of your fraud detection mechanism. How Does It Work For simplicity, we will take two algorithms. The first one is random. With an equal balance of classes, our error matrix will look like this: We will find half of the fraud and classify half of the legitimate events as fraud. The second one is almost perfect. With an equal balance of classes, our error matrix will look like this: Among all fraud, we will find 98% of objects. And we will also mark 98% of all legitimate events correctly. Now, let's calculate our error matrix for these algorithms for class balances. This can be implemented as follows: def random_algorithm(count_0, count_1):
    TN = count_0 * 0.5
    FP = count_0 * 0.5
    TP = count_1 * 0.5
    FN = count_1 * 0.5
    return TN, FP, TP, FN

def perfect_algorithm(count_0, count_1):
    TN = count_0 * 0.98
    FP = count_0 * 0.02
    TP = count_1 * 0.98
    FN = count_1 * 0.02
    return TN, FP, TP, FN We will also calculate the main metrics that are interesting to us: recall = TP / (TP + FN)
precision = TP / (TP + FP)
TNR = TN / (TN + FP)
NPV = TN / (TN + FN) Essentially, all of these metrics can be read as “the more, the better.” Now, let’s compare Recall and Negative Predictive Rate, which show how well we detect fraud, and Precision and True Negative Rate, which demonstrate our methods' accuracy. We must take different proportions of classes and assume that our error costs are approximately equal. If they are not identical, we can add these as weights to the class balance, and our graphs at the beginning and end along the x-axis will be more stretched, but the general idea will remain the same. For a random algorithm, Recall is constant and equal to 0.5, while NPV falls. NPV becomes worse as soon as the share of fraud events in the entire flow increases. This shows a lot of fraud in all the events remaining after cleaning. As for the metrics about "good" traffic, TNR remains constant since we detect the same share of good traffic with our algorithms and the Precision approaches 1. In fact, we still impact half of the legitimate traffic. Let's look at an algorithm that works much better than a random one. From the point of view of fraud, Recall remains the same, but NPV drops since, despite the very good quality of the algorithm, even with a large amount of fraud on the entire stream, we will still miss a lot of fraud traffic. We banned 99.9% of the traffic from the DDoS attack, but the remaining 0.01% was so much that the service still suffered from it, and the 99.9% ban did not help. From the legitimate traffic point of view, TNR remains unchanged, but precision increases. If it is essential for a business to understand what share of users “suffers” from our anti-fraud algorithm, then the TNR metric will more accurately show this problem. Here's a practical example of an online service with reviews and ratings where we ask users to leave reviews that we use to form a rating of the object. On this service, we see attempts to inflate ratings using fake reviews. Let's imagine we have a model with almost perfect quality, where we will catch 98% of all fraud and only 2% of reviews from people will not be considered to form a rating and list of reviews. In the following graph, the good reviews are growing a little and have a weekly trend. The bad ones don't have a clear trend, usually staying low, but we have about 30 days with a big spike. Let's calculate metrics for our algorithm. Here, Recall is stable, and we consistently find 98% of all fraud. But NPV shows us that there are fewer actual orders. Previously, we formed a description based on 0.99 legitimate and 0.01 fake reviews, when 0.01 could not significantly affect the overall picture and user experience. When the balance shifted to 0.94 and 0.06, we had a much greater risk that inflated reviews could mislead our users. Recall does not show this picture. And here, the TNR is stable, and we continue to ignore 2% of real users. This 2% does not significantly reduce our review coverage and ability to form a rating. Precision increases during the growth of fraud traffic, although there has been no product improvement. Recall and Precision are excellent metrics for fraud prevention. Still, since the class balance can change sharply or smoothly throughout the year, I recommend using more product metrics based on the error matrix. So, we've discussed binary classification metrics, but there are other approaches you can use to measure your success. Let's look at them briefly. Impact on the product. For example, you can allow some fake reviews, but if you rank them very low, no one will scroll to them. If you have 0.1% of such reviews on the entire flow, then only 0.0001% of users will see them. Or you can consider scores to form rankings with different weights. Estimates that you are less confident about will have less impact. Cost of fraudulent services. Often, there is an open market for rating cheating services where fraudsters can buy fake reviews. You can take the cost of services in this market as a metric, so your task is to make it higher than the economic feasibility of cheating a rating in the system. Conclusion Navigating fraud prevention requires a nuanced understanding of classic metrics and those directly tied to business outcomes. In a perfect scenario, various metrics would be used, considering absolute values, diverse data sources, and fundamental quality indicators. But often, we are forced to choose a minimal set of metrics, for example, for our commits and project goals. I recommend not stopping only at Recall and Precision. It's crucial also to consider metrics that reflect the real-world consequences. If you want to choose the right metric to measure the impact on the product, look at other options.

Beyond Recall and Precision: Rethinking Metrics in Fraud Prevention

A potent method for encouraging individuals to engage in any activity is through word of mouth. It stands as one of the most impactful strategies for acquiring and losing customers or users swiftly. Businesses aim to expand their customer base and reduce customer turnover. This goal has led to the exploration of different strategies. One prominent approach is advertising through various channels, both online and offline, which strongly influences people to consider the offered products or services. Another method I've come across is using incentives. This involves offering value to individuals, motivating them to engage in word-of-mouth promotion, and ultimately attracting new potential customers and users. The word that easily conveys the marketing epistle above is referral systems, and having built a few code-led referral marketing campaigns, I am opining that there are two types of referrals which I consider and referral systems. “Open” “Closed” A closed referral system The term itself implies a sense of control, where information is shared and (Know Your Customer) is performed for the newly obtained lead. Once this process is finished by the lead, the referrer receives the incentive. The closed system provides a way to prevent misuse and maintain control. KYC Open referral system You can consider them to be like open season. There is no throttle of access and the conversion metric in this case is majorly getting people to land on a page, hoping that the page provides conversion or can lead people to perform a task without being prompted. Enough of my shallow marketing information from here. Engineering-wise, The Closed Referral System seems to offer more control and suggests gaming can be prevented or controlled. Although I agree the engineering piece below will harden the closed system. Some engineering finally. Here, I will provide a user story where your implementation would be solely up to you. Open Referral Campaign - User Story In a presale campaign, a product affiliate link is used to showcase the product to potential customers. The goal is to attract traffic, and each marketer who generates traffic becomes eligible for a publicly agreed incentive, as outlined in the Terms and Conditions. In this case, we will be marketing and trying to increase acquired users in Nigeria. Spotify I assume that we've implemented this code in our preferred programming languages. We have a prototype in place, and when server requests are made, we guide them toward the final objective while also maintaining our internal records. However, we are aware of the possibility of misuse, where if someone uses the same device to make requests multiple times, the count increases accordingly. An illustration So, let's assume I am trying to get people to use Spotify such that if I get a 100 referral count my incentive is free Spotify premium for a Family circle. Yes, it makes sense to use a closed system such that the new lead joins Spotify and then the referrer gets his count increase. But, let's assume that it is an open referral campaign, I could click on my link 92 times to get to the score/statistics that I am interested in. Case in point: my count increased to 9 because I clicked on the link. This poses a challenge, how can we prevent gaming? I present to you encoding-serialization and data structures. I used a hash map as the source of the truth that keeps track of the data. it is adaptable to all cases so let me explain my reason for a hashmap. FYI: hashmap is a Dict in Python, Object in Js, Struct in Go etc. The Time and Space Complexity of this data structure is the reason for my decision, the keys being unique and values being extensible (malleable, it is another data structure). The only thing that could grow is the space of the data, lookups are at constant time, same with inserts which means that I could look up and if the lookup is false I could insert. https://gist.github.com/philipokiokio/62df7226e33d42ac1a0f6f05e1bf89a9?embedable=true Else Predication This is from line 33 in the gist above. So if gaming_data is empty that means that the device that clicked on the link is a unique visitor and as such the click is considered legit and not gamed. We can increase the count score and also provide the end-goal URL if there is any, if not the URL would be a string of length 0 specified on line 4. If Predication There are two cases possible here. 1. The data of interest is not in the dict and then we assign the data in dict. 2. The data exists in the dict but in the value (which is also a dict) the value of interest. (link_code) does not exist. When this is the case we add the data to the value. The reverse is when it exists in that case we get the URL and return it. This function just manipulates data, outside of this function there are a few things that can be/should be done. Updating the record in the DB based on the fact that the URL length is > 0. Another way to do the following statement is if the URL length is 0 throw an HTTPException, if this condition does not run then update the record score and return the URL. This implementation requires a process to close it out, the first thing is to encode the dict to a string format. Here is an example below: I used a package in Python called to convert the gaming_data dict to a string that decodes back to the data structure of its input. ItsDangerous Now we have concluded the backend’s part of this solution, our system is meant to expect this gaming token to come with the request from the client side to the backend. So I will leave how you attach the data to your discretion, there are numerous decisions that can be made, query params or headers. The Frontend/Clientside is the gatekeeper of this implementation, to explain what occurs let me show you the response now with this implementation. In this response, we return the URL and a token to the client side, the clientside could help us store this token in the device of whoever clicks our link. The implementation of the request from the frontend to the backend should check for this token, if this token exists we then include it in whatever method we decide. So the Count should have increased to 10 with the request above. Here is how I specified for the token to be sent back to my system. If we check the score for the owner of the link it should freeze at 10 and not increase (fingers crossed). The count is frozen. One thing that should be pointed out is that we would always provide a token irrespective of the data in the token, as such we can continually rotate the token. The above is how I architected a fraud prevention system, that involves backend heavy lifting and syncing with the frontend. There is a potential way to persist this data in the backend. Recently, I attempted to explore user agents, but I just learned that user-agent can be spoofed so I am looking for a fail-proof way to identify devices. If that is possible we can persist this token in a table and the identifier can be stored in a device table and foreign_keys could be used to relate between them or whatever method you would prefer. The fraud system layered on the closed referral system reduces the chances of gaming and even my suggestion above could be implemented especially since we know the primary key of each user, the referer, and the new lead. Till next time, peace! Also published here.

Building Secure Open Referral Systems: Harnessing HashMaps for Effective Fraud Prevention 

Hi Everyone, I would like to draw your attention to some key insights from two comprehensive reports, shedding light on the importance of fraud prevention as a burgeoning field with substantial job prospects. The original reports can be accessed through the link provided at the end of this post. Firstly, let's consider a couple of significant events from the previous year that remain highly relevant. Retail e-commerce sales surged to a staggering , with projections indicating a further increase to $8 trillion by 2026. Furthermore, the percentage of shoppers making cross-border purchases rose from 69% in 2019 to an impressive . $5 trillion 76% These statistics affirm that online shopping is not a passing trend, as consumers are willing to make purchases from international vendors, even if it means enduring longer delivery times in exchange for lower prices. From a fraud prevention perspective, this highlights the escalating number of non-domestic payments and the rise in the use of lost or stolen cards for purchasing goods that can be resold in the future. Notably, refund fraud is becoming increasingly prevalent. However, many businesses have adapted their rules to accommodate these challenges. One such positive development is the gradual disappearance of restrictions on using payment methods that do not match the account country. As cross-border purchases continue to proliferate, alternative payment methods are also on the rise. Current global statistics indicate that an average of four payment options are now available on merchant platforms. Additionally, open banking payment transactions are projected to surpass , leading to a greater diversity of alternative payment methods. $330 billion globally by 2027 As companies embrace these methods, they are also becoming more aware of the associated risks. For instance, direct banking payment methods present unique challenges as they lack refund capabilities, while Buy Now Pay Later (BNPL) options introduce their own set of risks. This convergence of factors positions fraud prevention as an excellent career opportunity. Numerous companies, particularly in the Fintech sector, are actively seeking fraud experts for the present and future. While the tech industry has experienced job cuts, the demand for fraud experts remains robust. Furthermore, countries in the rapidly expanding Latin American e-commerce market, such as Mexico and Brazil, are anticipated to increase their fraud prevention teams by over 20%. Australia is also actively looking to expand its fraud teams by a similar margin. Worldwide, less than 3% of merchants are expected to downsize their fraud prevention departments. If you are contemplating which industry to pursue, I strongly recommend considering fraud prevention as a promising path. Typically, fraud teams work collaboratively across various departments, including Engineering, Finance, and Marketing. As fraud becomes an increasingly captivating topic within organizations, certain departments, such as Data Science and Engineering, are also experiencing growth. This expansion is driven by the implementation of tools dedicated to fraud prevention. Most companies utilize a combination of internal and external solutions. Notably, there is a clear correlation between rising fraud figures and an increased reliance on external providers, which can be costly and strain budgets. Machine learning (ML) emerges as the most expensive option. In the context of fraud prevention, ML is often utilized in conjunction with rule-based systems. It is important to note that not every company requires an internal ML solution; in many cases, external ML solutions are more effective and cost-efficient. However, larger organizations that exhaust their budgets on external solutions may ultimately benefit from implementing an in-house solution and gradually upgrading it. Although this transition may not occur immediately due to the necessary adjustment period, it proves to be the optimal long-term approach. Consequently, we observe the growth of Data Science and Engineering teams within the realm of fraud prevention. If you still harbor doubts regarding the value and contribution of fraud prevention to businesses, let me emphasize one final point highlighted in these reports: chargebacks. This subject is widely recognized within the industry, and anyone involved in payment processing is familiar with it. According to data from Mastercard, the global volume of chargebacks reached a staggering in 2021, resulting in an estimated cost of approximately $117 billion (based on an average chargeback cost of $191). While most merchants handle chargebacks internally through their fraud teams or dedicated dispute management teams, the global average for successfully challenging chargebacks stands at 44%, with an average success rate of 60%. 615 million These figures serve as a strong impetus to hire more fraud experts and establish dispute management teams focused on effectively handling chargebacks and recovering funds for the company. By combining proactive prevention measures with an efficient dispute management strategy, companies can significantly impact their key metrics. For those seeking a fulfilling career path with meaningful impact, the field of fraud prevention offers immense potential. The convergence of technological advancements, evolving payment methods, and the persistent threat of fraud make it a dynamic and rewarding domain. By joining the fight against fraud, you can contribute to safeguarding businesses, fostering trust among consumers, and driving the growth of the digital economy. Please find the link to the original reports below for further information. Fraud detection specialists in short supply as industry plans hiring push Global fraud trend Thank you for your attention. — — — — - “The views and opinions expressed in this article are solely my own and do not express in any way nor are endorsed by my employer. They are not based on my experience as an employee of Bumble”

The Growing Field of Fraud Prevention: Insights and Career Opportunities

Online advertising has become crucial for a business to thrive in today's digital age. With the ability to reach millions of potential customers through targeted ad campaigns, businesses are investing heavily in their advertising budgets. However, a looming threat can undermine these efforts: ad fraud. In this article, I'll delve into the complex issue of ad fraud and explore its three main types. I’ll teach you to recognize them and guide you on what to do when you suspect any fraudulent activity. Additionally, we'll discuss various ad fraud prevention techniques that businesses can implement to protect themselves and their campaigns. Understanding Ad Fraud Ad fraud refers to any activity that generates fake ad impressions or clicks, tricking advertisers into paying for non-existent or ineffective ad campaigns. The impact of ad fraud on advertising budgets can be devastating, resulting in wasted resources, lost revenue, and damage to brand reputation. Ad fraud is estimated to cost the advertising industry billions of dollars annually. With online marketing becoming increasingly sophisticated and diverse, ad fraud has grown in both scope and complexity. Let’s take a look at the three primary types of ad fraud to watch out for. Click Fraud What is click fraud? Click fraud is a type of ad fraud that involves interfering with user interactions with ads. One typical example is click-spamming, where a fraudster intercepts a real user's click from another source (such as an organic or advertising click) and assigns it to themselves by generating multiple automatic clicks. The user may then install the application, but the analytics system will attribute the installation to the fraudulent partner and not the source. How can you detect it? Fortunately, detecting this type of fraud is easier than the others. One way is by analyzing statistics. Unlike a real user, a fraudster does not download the application, so fictitious actions will show in the numbers. Abnormally frequent user clicks, short intervals between a click and an install, a sharp one-time increase in installs, and, of course, a low conversion rate should alert you. Usually, the figures are compared with the average for the last few months. You can also analyze the source of the traffic to make sure it's diversified, with no single authority responsible for a significant portion of the traffic. However, Apple's privacy policy , which allow users to restrict access to ad interaction data in AppStore apps, have made detecting click fraud more difficult. This means that some data for analysis and fraud detection may not be available. updates Hardware Fraud What is hardware fraud? Fraudsters can use bots that imitate app installs, and I classify this type of fraud as hardware fraud. It is commonly found in gaming apps on Android, as there are many pre-built emulators available. Another way fraudsters engage in hardware fraud is by using virtual machines or cloud servers to simulate multiple devices and generate fake installations. In this case, the fraudster may use different IPs and locations to create the impression that the installs come from different devices and users. How can you detect it? To detect hardware fraud, you can use an anti-fraud system to automatically check the device settings during installation. The system can flag inconsistencies such as incorrect device models or operating systems that don't match the real device. For example, a fraudster may indicate a priority phone or browser model that does not match the device. Detecting the second type of hardware fraud can be more challenging since fraudsters can make the device's characteristics and location appear legitimate. In this case, you might need to run a more thorough analysis of behavior patterns to detect inconsistencies in the data. Behavioral Fraud What is behavioral fraud? This is a rather sophisticated form of ad fraud where bots mimic human behavior and engage with the app. These can also be real people who are paid to perform simple tasks, for example, in dating apps, where ad budgets are spent not only on installations but also on user activity. Another example of behavioral fraud is incentivized traffic, where users are offered rewards or incentives for downloading and using an app. Since these users are only motivated by the reward, this creates a low-quality user base that is unlikely to generate revenue for the advertiser. Numbers of installs and user engagement skyrocket, but there’s hardly any value in them. How can you detect it? Start by analyzing user activity statistics. If user sessions are abnormally frequent, long, or too short, this might be a tell-tale sign you’ve become a victim of fraud. Again, compare these indicators with the last few months’ average values to identify anomalies. Additionally, analyzing the quality and attention of users to the app over time can help to detect incentivized traffic fraud. Platforms Most Affected by Fraud Web First and foremost, there’s web fraud. In essence, it involves generating fake traffic on websites to artificially increase the number of ad impressions, clicks, and conversions. Advertisers pay for this non-existent or low-quality traffic, leading to wasted advertising budgets and decreased ROI. Research shows that web fraud is more prevalent than other forms of online ad fraud, with websites being targeted 25% more often than mobile apps. All types of websites, from news and entertainment to e-commerce and social media, can be affected. However, websites with low traffic volume or lower quality control in their ad networks are more prone to fraud. Video ads are a prime target for fraudsters, accounting for almost of all ad fraud.   A common tactic here is to pass off banner ad space as video placement and sell it at a higher price. 64% Mobile Mobile app fraud is a significant issue in the programmatic ecosystem. , exposure to fraud has skyrocketed by 157% to $5.4 billion worldwide. Unlike desktop fraud, mobile app fraud often operates through downloads from trusted marketplaces such as the App Store or Google Play, making it difficult to detect and prevent. The traditional web fraud tracking model simply wouldn’t work. According to McKinsey One of the most common types of mobile app fraud is click injection. Fraudsters use malware to trigger fake clicks just before an app is installed or updated. The worst part is, these clicks can look like they're coming from real, legitimate users, making it hard to recognize them as fraud. iOS vs Android In 2020, in an effort to combat ad fraud and disruptive advertising, Google removed around 600 Android apps and banned their developers from the Play Store. Naturally, the problem of fraud in mobile advertising affects both iOS and Android platforms, but scammers tend to target Android devices more often because they make up a larger portion of the market. As much as 90% of all mobile ad fraud affects Android. Also, Android devices have higher levels of hardware fraud than iOS devices ( )—they are easier to emulate and have an open-source architecture that makes it easier for fraudsters to generate fake traffic. 37% vs 24% When it comes to the iOS advertising ecosystem, fraudsters find it attractive for different reasons, particularly due to the higher CPM (cost per thousand) rates compared to Android devices. iOS devices actually have a greater share of post-install fraud than Android devices— . The loss of user IDs on iOS can also lead to a rapid increase in fraudulent activity in mobile applications. 55% compared to 34% Non-Gaming Apps vs Mobile Games It appears that non-gaming apps are particularly vulnerable to fraudsters, with financial, travel, and shopping apps being the most targeted. Fraud in non-gaming apps is often carried out by bots, which go unnoticed and target less visible elements of apps and user engagement. In contrast, gaming apps appear to be more immune to fraud, with only 3.8% of game downloads being fake, . This might be because mobile games typically use the CPA (pay-per-action) model for advertising. Yet, click spam and attribution hijacking can still be an issue in gaming apps. according to AppsFlyer CTVs Connected TV ad fraud has emerged alongside the growing popularity of streaming services. One common type of fraud is spoofing, where scammers copy real audiences watching ads on CTV devices. They use techniques like IP, device, SDK, and Server-Side Ad Insertion (SSAI) spoofing to steal ad revenue. According to , the global CTV ad fraud rate rose from 14% in Q2 2021 to 19% in Q2 2022. To combat CTV ad fraud and improve their return on ad spend, advertisers must focus on precise audience targeting, which can help them detect fraudulent activity. Pixalate's research Preventing Ad Fraud Machine Learning in Antifraud Systems Machine learning, with the ability to analyze enormous datasets in real time, is changing the game when it comes to preventing app fraud. One of its key applications is anomaly detection, which means identifying unusual or suspicious activities in an ad campaign. If you train the algorithm over historical ad data, the system will establish a baseline of normal behavior and then spot deviations from this norm. For example, if there's a sudden spike in click-through rates or a disproportionate number of ad impressions from specific geographic locations, it can be flagged as potential fraud. Even more impressively, these advanced algorithms can recognize more subtle forms of fraud, such as click farms and bot traffic, which can easily go unnoticed if traditional detection methods are used. To make anti-fraud systems even more powerful, companies can use a mix of supervised and unsupervised learning techniques. Supervised learning involves teaching the algorithm using labeled data, where fraud instances are explicitly identified, helping the model recognize similar patterns in the future. SML-based systems demostrate good results at detecting already known types of fraud. On the other hand, unsupervised learning doesn't need labeled data; the algorithm autonomously identifies clusters or patterns in the dataset. Such algorithms are more adept at identifying new types of fraud. By combining these two methods, organizations can build resilient and comprehensive anti-fraud tools. Impression Tracking Merely relying on validation methods to ensure that the ad impression is genuine may not always be sufficient—fraudsters can manipulate the system by selectively removing validation pixels from fake impressions while retaining the advertiser's pixels. This is why it's crucial to compare your ad impressions against third-party validator stats and analytics. Also, it's important to use a unique validation pixel for every impression. Some may choose to check every second or third impression to save the budget on monthly limits, but scammers can detect and mimic this frequency, rendering it ineffective. Here's a real-life example that shows how crucial it is to remain vigilant when combatting fraud. I personally know a team that works closely with validators to keep track of discrepancies in ad impressions. When they changed the validation frequency from every second impression to every impression, they noticed a significant surge in invalid traffic coming from a particular publisher, indicating that the previous frequency was intercepted by scammers. Blocking Multiple Requests Rate limiting is an extremely effective way to mitigate bot activity. Essentially this strategy involves monitoring the number of requests and blocking duplicate ones. First, the system tracks the IP address and time between individual requests, which helps to identify the source of a request and restricts processing when a specific IP generates an excessive number of requests within a given time frame. This technique helps prevent DoS and DDoS attacks, web scraping, and botnets. It also reduces the load on web servers and prevents API overuse. Blocklists Another way to combat fraud in advertising is by creating blocklists of vendors and platforms known for spreading fraud. Implementing these lists effectively stops fraudulent traffic from entering the system. Many systems maintain internal blocklists that are updated frequently; also, developers often rely on third-party data. They check databases for parameters such as IP addresses, device information, application IDs, domains, and potentially harmful applications. Real-Time Bidding Real-time bidding allows advertisers to bid on individual ad impressions in real time, ensuring their ads are served to the most relevant users. This increased control minimizes the chances of their ads being displayed on fraudulent websites or being viewed by non-human traffic, e.g. bots. Furthermore, RTB platforms often incorporate advanced security measures and fraud detection tools that help identify and block malicious activities. They constantly monitor and analyze bid requests, capable of promptly detecting patterns indicative of ad fraud, such as abnormal click-through rates or unusual traffic sources. This makes it more difficult for fraudsters to exploit the system. Conclusion The economic impact of fraudulent advertising is staggering. A few years ago pointed out that damages due to ad fraud and spending on bot traffic were expected to rise from $35 billion to $100 billion between 2018 and 2023, reaching over $80 billion in 2022. More recently, the Association of National Advertisers (ANA) reported that the cost of ad fraud has reached an astounding $120 billion annually—the number has already topped Statista’s grim forecast. Advertisers in the United States suffer the most significant financial losses, amounting to $23 billion.__ __Research by indicates that 24% of traffic is generated by bots used for scams and theft. found that 31% of iOS app installs and 25% of Android app installs are fake, while TrafficGuard and Juniper concluded that one in every 13 app installations worldwide is fraudulent. Statista Juniper Interceptd This 2022 data highlights how important it is for businesses and marketing teams to timely detect advertising fraud. Otherwise, they risk spending budgets on bots and fake traffic instead of potential customers. We also need to keep in mind that since programmatic advertising is developing rapidly, effective detection processes for fraudulent traffic may take time to catch up. Let's recap the strategies advertisers can use to combat fraud: Use systems powered by a combination of supervised and unsupervised ML. Install advanced analytics and traffic inspection tools to get more data for attribution analysis. Cross-reference data from different sources, e.g. verify proprietary data against that of third-party validators. Implement rigorous screening processes using blocklists of fraudulent and suspicious traffic, regularly updating and cross-referencing these lists with third-party vendors. Employ impression tracking and filters to ensure the safety of advertising traffic. Sources BotFAQtor Blog, 3 Reasons to Protect Your Ad Campaign from Fraud in 2023, https://botfaqtor.ru/blog/3-dovoda-v-polzu-zashchity-reklamy-ot-onlayn-moshennichestva-v-2023-godu/ VC.ru, Top 10 Tools to Combat Click Fraud by Maksim Kulgin, https://vc.ru/services/617098-top-10-servisov-pomogayushchih-borotsya-so-sklikivaniem-v-reklame Admon.ai for VC.ru, Everything You Wanted to Know about Web and Mobile Ad Fraud But Didn’t Dare to Ask, https://vc.ru/marketing/446864-moshennichestvo-v-onlayn-reklame-vse-chto-vy-hoteli-znat-o-frode-v-vebe-i-mobayle-no-boyalis-sprosit VC.ru, How to Recognize Ad Fraud, https://vc.ru/promo/467877-fraud-online OneSpan Blog, Preventing Fraud, https://www.onespan.com/ru/topics/predotvrasenie-mosennicestva My Tracker Blog, The Ultimate Guide to Identifying and Preventing Mobile Ad Fraud by Ivan Mazharov, https://tracker.my.com/blog/216/the-ultimate-guide-to-identifying-and-preventing-mobile-ad-fraud?lang=en#:\~:text=SDK Spoofing,or%2C potentially%2C engagement signals VC.ru, A Guide to Preventing Ad Fraud: How to Run Secure Advertising Campaigns?  by Yaroslav Kholod, https://vc.ru/marketing/159440-gayd-po-borbe-s-reklamnym-frodom-kak-obezopasit-kampanii-ot-moshennichestva PWC, PwC’s Global Economic Crime and Fraud Survey 2022, https://www.pwc.com/gx/en/services/forensics/economic-crime-survey.html Apple Developer Support Articles, User Privacy and Data Use, https://developer.apple.com/app-store/user-privacy-and-data-use/ Business of Apps, Ad Fraud Statistics (2023) by Artyom Dogtiev, https://www.businessofapps.com/ads/ad-fraud/research/ad-fraud-statistics/

Ad Fraud Prevention: How to Protect Your Online Advertising Budget

Cross-Site Scripting (XSS) Explained When creating an application with a non-CLI interface, it is crucial to prioritize frontend security to ensure the integrity of your system. One of the most critical risks that poorly implemented frontends can lead to is cross-site scripting (XSS). While many articles and courses touch on the topic of security in web application development, they often fall short of providing comprehensive explanations. Therefore, it is essential to delve into the vulnerability of , understand its root causes, explore potential exploitation methods, learn the proper utilization of the , and ultimately grasp effective measures to safeguard any frontend application against the XSS threat. XSS React framework What is cross-site scripting? Cross-Site Scripting (XSS) is a vulnerability that occurs in applications that process HTML when developers do not sanitize user input well enough before inserting it into an HTML template. It allows an attacker to insert arbitrary JavaScript code into a template and execute it in the user’s context: code-injection In the image above, the developer failed to sanitize the content of the "last-name" div, which resulted in users being able to include malicious scripts by manipulating their last name. Is XSS common? Despite the fact that numerous frameworks and libraries provide users with all the necessary tools to get rid of XSS, this is still one of the most common vulnerabilities found in web applications. It consistently appears in the OWASP list of the Top Web Application Security Risks and was used in 40% of online cyberattacks against large enterprises in Europe and North America . According to HackerOne, XSS vulnerabilities are the most common vulnerability type discovered in bug bounty programs. in 2019 Where can I spot XSS vulnerability? There are 2 types of Cross-Site Scripting: Client-Side XSS Server-Side XSS The most common kind of XSS. It happens on the client side (in browsers or desktop apps) and is a consequence of not properly sanitizing user-supplied data before inserting it into the DOM.This is quite rare, however, possible. It happens when the server transforms HTML files into other documents (most likely, PDFs) and the library does not whitelist what kind of code it executes. You can read about Dynamic PDF vulnerability on . HackTricks Is XSS really that dangerous? Simply put, it’s a disaster. Here’s a list of what an attacker can do if they’re able to exploit an XSS vulnerability on the client side: Remote Code Execution (Browser exploits, CMS exploitation) Session Hijacking Bypass CSRF protection Keylogging Forced Downloads Man-in-the-Middle Attacks All sorts of phishing: Credential Harvesting, Ad-jacking (Ad injection), Clickjacking, Redirecting users to a malicious website, etc. Stealing data from local- session- web- storages, cookies, IndexedDB, page source code, taking screenshots DoS and DDoS Content Spoofing Pivoting into hidden, internal networks, protected by firewalls: JS can be used for host & port discovery, service identification, and interaction (Is extremely slow) Stealing geo-location, capturing audio, web camera, or gyroscope data (requires explicit permission) Crypto mining (Is hard, the browser will try to protect a user) Server-Side XSS is even worse because it allows: Remote Code Execution Local File Inclusion Server-Side Request Forgery Internal Path Disclosure Stealing information from the result document DoS Crypto mining The attacker is also able to get information and control the tab in real-time mode: Misconceptions about XSS “XSS is not a threat if the website uses HTTP-only cookies for authentication” I hear that a lot, and that’s just ridiculous. Yes, an attacker can’t steal HTTP-only cookies with JavaScript; however, they don’t even need to. The true danger of XSS comes from the ability to execute arbitrary JS in the current user’s context. If an attacker can’t steal the cookie and attach it to malicious requests made from their machine, they’ll just move the malware into the victim’s browser, and the browser will attach the cookies for them. I admit, the exploitation becomes more complicated; however, it’s A LOT stealthier and safer for the attacker. “XSS is a non-persistent type of attack #1: I leave the vulnerable page and it’s fine” Wrong again! Once an attacker can inject arbitrary JS into your browser, they can change the application’s behavior so that you NEVER leave the vulnerable page. By manipulating requests/responses and the HTML DOM, they can make it seem like you left the page by re-rendering new content on the vulnerable page. However, this kind of trickery can be defeated if the user manually types the URL they’re interested in into the address bar. “XSS is a non-persistent type of attack #2: I just leave the website and it’s fine” Not true: malicious JavaScript files CAN be persisted in your browser. That’s rare, but still possible via Server Workers. To register a malicious service worker, one of the following conditions must be met: An attacker has write access on the frontend server There’s an unfiltered JSONP endpoint exposed If an attacker manages to register a malicious Service Worker, they can maintain persistence in your browser indefinitely. Service Workers can be used to sniff and modify traffic (for instance, to supply new malicious scripts with each response). Check out for more details. the ShadowWorkers project How many types of XSS are there? There are several different ways of XSS manifestation. Security specialists usually single out 3: DOM XSS stands for Document Object Model-based Cross-site Scripting. A DOM-based XSS attack is possible if the web application writes data to the Document Object Model without proper sanitizing. The attacker can manipulate this data to include malware on the web page. Key points: Dom-Based XSS. Generally, DOM-Based cross-site scripting attacks are client-side attacks. Malicious code might never reach the server. Malware is executed AFTER the HTML template is rendered; it happens at some point during runtime. Reflected XSS occurs when the server takes a part of a request and inserts it into the response without proper sanitizing. Key points: Reflected XSS. Reflected XSS payload ALWAYS reaches the server; it is part of both request and response. Unlike DOM-Based XSS, Reflected XSS payload is executed WHILE a browser renders an HTML template since the payload is part of the response and usually is embedded into the template. Stored XSS happens when developers blindly trust data that’s being stored in their databases, web-caches, files, etc. Key points: Stored XSS. Stored XSS is saved somewhere (not necessarily the database) for a while The payload might be executed on multiple pages and usually does not require any user interaction to fire (unlike DOM-Based and Reflected XSS, which are usually spread via malicious links and require user interaction). If I use React, am I safe then? Surprise reveal: React is not fully safe from XSS, although it really tries to protect users from it. There are several ways to inject malicious JS into a React app: React does not filter what you’re passing to props: (Exploitation via “javascript:” or “data:text/html” URI) href (Exploitation via “javascript:” or “data:text/html” URI) src (Exploitation via inserting malicios HTML) srcDoc (Exploitation via “eval(...arbitrary js)”) formAction (Exploitation via “javascript:” or “data:text/html” URI) data React also allows you to directly manipulate the DOM, bypassing its restrictions and protections. You can achieve this by using the prop. As a “Security precaution”, React ignores tags whenever they’re inserted into . This protection can be easily bypassed by modifying the XSS payload, like: dangerouslySetInnerHTML <script> dangerouslySetInnerHTML Using or <iframe src=”javascript:eval(...)”/> <img id=’_malware_’ src=’x’ onerror=’eval(this.id)’ /> Such mutations allow you to inject tags into the DOM <script> The last known way to inject malicious code into a React app is by abusing the user-controlled props object. If an attacker has control over the props object’s keys, they might be able to embed an exploit by either abusing , , , , , or by poisoning props with . This is especially dangerous if users have control over the JSX tag that’s being inserted into the React tree. href src srcDoc data formAction attributes dangerouslySetInnerHTML How can I prevent XSS? The first step would be to encode data on output. According to , encoding should be applied directly before user-controllable data is written to a page because the context you're writing into determines what kind of encoding you need to use. For example, values inside a JavaScript string require a different type of escaping to those in an HTML context. Portswigger Web Security Academy In an HTML context, you should convert non-whitelisted values into HTML entities: converts to: < &lt; converts to: > &gt; In a JavaScript string context, non-alphanumeric values should be Unicode-escaped: converts to: < \u003c converts to: > \u003e Validate input on arrival You should validate any user input as strictly as possible. For instance: If a user submits a URL, manually cast it to a URL class and verify that it starts with a safe protocol (HTTP / HTTPS) If a user supplies a value that is expected to be numeric, explicitly cast it to a number Validate that input contains only an expected set of characters Whitelisting and blacklisting Input validation should generally employ whitelists rather than blacklists. For example, instead of trying to make a list of all harmful protocols (javascript, data, etc.), simply make a list of safe protocols (HTTP, HTTPS) and disallow anything not on the list. Allowing "safe" HTML The best option is to use a JavaScript library that performs filtering and encoding in the user's browser, such as DOMPurify. Other libraries allow users to provide content in markdown format and convert the markdown into HTML. Unfortunately, all these libraries have XSS vulnerabilities from time to time, so this is not a perfect solution. If you do use one, you should monitor closely for security updates. If you’re using a frontend framework, your other option is to parse it into that framework’s elements, like in the JSX tree in React. There are libraries that do that, however, parsing it manually is not that hard, so if you know exactly what kind of HTML you’re supposed to render, it might be safer to do it yourself. That way, you’ll definitely avoid dangerous props, event handlers, and harmful CSS. Mitigating XSS using Content Security Policy (CSP) CSP is the last line of defense against cross-site scripting. If your XSS prevention fails, you can use CSP to mitigate XSS by restricting what an attacker can do. CSP lets you control various things, such as whether external scripts can be loaded and whether inline scripts will be executed. To deploy CSP, you need to include an HTTP response header called Content-Security-Policy with a value containing your policy. An example of CSP is as follows: default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'none'; This policy specifies that resources such as images and scripts can only be loaded from the same origin as the main page. So even if an attacker can successfully inject an XSS payload, they can only load resources from the current origin. If you require the loading of external resources, ensure you only allow scripts that do not aid an attacker in exploiting your site. For example, if you whitelist certain domains then an attacker can load any script from those domains. Where possible, try to host resources on your own domain. If that is not possible then you can use a hash- or nonce-based policy to allow scripts on different domains. A nonce is a random string that is added as an attribute of a script or resource, which will only be executed if the random string matches the server-generated one. An attacker is unable to guess the randomized string and therefore cannot invoke a script or resource with a valid nonce and so the resource will not be executed. Server-side protection Using server-side protection, such as Web-Application Firewalls and Intrusion Prevention Systems, can help you reject XSS payloads sent to your server. For instance, AWS WAF and Snort IPS have sets of rules that detect the most common XSS payloads, such as . Additionally, IPS systems ship with known exploit traffic signatures, for example, Snort is able to detect and disrupt exploitation of CVE-2011-1897 – XSS vulnerability in Microsoft Forefront Unified Access Gateway. ‘<script>alert(1)</script>’ Beware of inserting user input into the "script" tag If an attacker is able to insert JS where it’s being evaluated, there's not much you can do. There are numerous ways to encode and mutate malicious scripts by using dedicated obfuscators or esoteric JS dialects, like Katakana, JJEncode, or JSFuck. Consider the following JJEncode snippet: ```js
$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")
[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$
$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.
$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.
$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+
(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.
$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.__$+")"+"\"")
())(); When inserted in a tag, it evaluates to alert(1). A home-baked regular expression can’t help because there’s not a single suspicious word or a control character in here. <script> Also published here.

Stories, News & Mentions about PREVENTIO

Preventio’s Stories on HackerNoon