How to Block Expediting Bots From Games & Applications

Expediting bots are automated threats typically used to gain an unfair advantage (aka to cheat) by speeding up tedious or time-consuming actions, often in violation of explicit or implicit rules for normal use of a gaming or betting platform, site, or application.

Discover why bot developers use expediting bots, how expediting attacks progress, possible defense strategies, and the best way to protect your online applications against expediting bots and all other OWASP automated threats.

About Expediting & Expediting Bots

Definition of Expediting

Expediting (OAT-006) is an automated threat that uses malicious bots to exploit your online APIs to speed up the progression of application processes for malicious intents.

Expediting bots are the automation programs and software attackers use to execute expediting quickly and easily. Beyond the security and user experience consequences of expediting, the bot traffic also causes issues like increased infrastructure costs and server overload.

Who uses expediting bot attacks, and why?

Fraudsters and malicious hackers use expediting bots to exploit application processes to gain an unfair advantage in online gaming, betting, financial trading, product purchasing, ticket buying, and more.

Use Case: Expediting for Cryptocurrency Gains

In the first quarter of 2018, attackers manipulated the centralized Binance cryptocurrency exchange to simultaneously increase the value of Viacoin from $3 to $200, while lowering the price of Bitcoin by 10.8% in a matter of minutes.

By obtaining access to registered API keys used to control Binance accounts through a (likely) compromised third-party app, attackers used automated expediting bots—such as Altcoinbot.io, for example—to perform rapid purchasing of Viacoin, causing Viacoin’s market capitalization to leap from 64 million to 159 million.

In the attack, expediting bots were programmed to take over a genuine user’s API keys for trading, sell all of the victim’s altcoins to BTC, and purchase Viacoin at a previously inflated price. Once Viacoin’s value skyrocketed, the attackers withdrew profits from compromised user accounts.

Defense Strategies Against Expediting

It is critical that online gaming, betting, ticketing, financial trading, and auctioning businesses have strategies in place to stop bot attacks. Common defenses against expediting bot attacks include:

Employing user behavior analysis to detect abnormal activity.
Building a user block list to ban repeat expediting offenders.
Identifying the application process being abused to prevent further abuse.
Enforcing API rate limit thresholds to flag high-frequency automated processes.
Using automated bot protection tools and processes to prevent expediting attacks on autopilot.

An advanced bot and online fraud protection solution can quickly identify anomalous user behavior that shows signs of expediting and automatically block malicious expediting bot if your API is protected. Blocking bots prevents the mistreatment of your application processes.

The Best Defense: How DataDome Protects Against Expediting

DataDome employs a sophisticated bot detection engine, based on artificial intelligence and machine learning, to help CTOs, CISOs, and other enterprise leaders protect their web applications, mobile apps, and APIs from malicious expediting bot threats.

DataDome’s solution deploys in minutes on any web infrastructure, is unsurpassed in detection speed and accuracy, and runs on autopilot with simple, customizable options. It is the only bot protection solution delivered as a service. Unlike competitors, it requires no architecture alterations or DNS redirecting and is never a single point of failure.

DataDome’s bot detection engine leverages aggregate global data to compare every hit to your site anew with a vast in-memory pattern database. It uses expert-monitored machine learning to determine in less than 2 milliseconds whether to grant or deny access. The algorithm scrutinizes billions of daily events (5 trillion signals per day) and continually updates to pinpoint both known and zero-day threats.

To see how DataDome can protect your online financial trading, gaming, betting, and ticketing sites from expediting attack bots, start your free trial or request a demo today.

Before DataDome was introduced, we were addressing the bad bot issue in incident response mode. Since the solution was deployed, we no longer see any malicious activity on our sites related to bot traffic. This type of activity is automatically mitigated with a CAPTCHA page. Nevertheless, we continue to analyze the logs in our SIEM to verify that DataDome is 100% effective and so far, it’s been the case.

IT Operations Manager, Enterprise (1,001-5,000 Employees), G2