New Threat on the Rise – Denial of Inventory Attack

OWASP (Open Web Application Security Project), a well known online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security released their first guide called Automated Threat Handbook in late 2015 which purpose is to show all documented threats related to attacks accomplished by leveraging an automated tool, or a otherwise called a “bot” to perform abusive actions against a web property or an API in high volumes.

How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%

Recently, their handbook was updated with a new threat that depletes goods or services in stock without ever completing the purchase or committing to the transaction called Denial of Inventory.

In short – the attacking bots select and hold items from a limited inventory or stock (they add them to their carts), but never actually purchase them. This renders legitimate users unable to buy, pay or confirm the items themselves.

Image Source

Symptoms

Also known as a Hoarding attack, Denial of Inventory is not a threat that should be ignored, being the symptoms of this specific attack are the following:

• Inventory balances reduce quickly
• Increased stock held in baskets, carts or reservations
• Elevated cart abandonment
• Reduced use of payment step
• Increasing complaints from users being unable to obtain goods/services

Targeted Sectors

The first question that anyone reading about this particular subject is about whether their online assets are under threat considering the business sector they operate in.

The usual targeted sectors are the following:

• eCommerce
• Travel
• Education
• Entertainment
• Financial
• Government
• Health
• Retail
• Technology

The Analysis

Even though Denial of Inventory was only just recently added to OWASP’s handbook, the threat has been around for some time now, typically targeting eCommerce websites.

The problem comes from the fact that online stores usually take an item out of the available inventory once it’s added to the shopping cart to enable the user to complete the purchase and not find out that it is out of stock until the checkout is completed. The usual amount of time that the item will be held out of the inventory for a potential new customer is around 10-15 minutes before concluding the shopper has left the website, after that time the item is returned to stock.

A Denial of Inventory bot will proceed to constantly add the item to the shopping cart (in this case every 10-15 minutes) which means that when the cart empties and the items are returned to the inventory, the automated bot will put them back in their cart continuing to do so indefinitely (or until the attack is complete).

Image Source

Technically, a Denial of Inventory attack is a specific form of an Application Layer DDoS attack (Distributed Denial of Service). In a typical DDoS attack, an attacker abuses the application in order to overload the server and prevent it from operating correctly by depleting its available resources.

In this case we’re looking at a business level, logistical denial of service where the user exhausts stock and blocks the website from selling the product and generating expected revenue. It is possible that this type of attack can heavily impact the revenue stream of the retailer by impacting margins, since when it becomes apparent that the hoarded goods were not actually sold the retailers must aggressively discount in order to sell the hoarded inventory.

How To Stay Safe

It is very important to understand that the Denial of Inventory attack is performed by an automated bot, and not a human and that they will likely repeat themselves. Businesses need to implement systems that will be able to identify actions like these so proper mitigation can be activated when needed.

Limit the absolute time shoppers can hold items in their carts by limiting the amount of times they can add the item to the cart in the first place. This can get tricky since bots are becoming increasingly intelligent and can change IP addresses and similar.

If you suspect bad bot abuses you should always turn to experts like GlobalDots to quickly turn the tables. Contact us today to help you out with your performance and security needs.