Unleashing the Power of Browser Automation in Cyber Attacks
Introduction
In the initial entry of our blog series, we explored the vulnerabilities associated with inadequate passwords, emphasizing the potential compromise of VPN credentials and the subsequent unauthorized access to entire corporate networks by threat actors. Moving forward in the subsequent segment of this series, we further investigated the ongoing challenge of brute force attacks targeting corporate VPNs. Organizations often face security risks as they commonly depend solely on VPN login credentials for the dissemination of VPN client software to unprivileged users. In this concluding segment, we will delve into the following:
- Browser automation is the game-changer in the world of cybercrime. Threat actors use it to streamline brute force attacks by automating web interactions, including navigation, form-filling, and data collection, making their malicious activities faster and error-free.
- Even non-tech-savvy criminals can harness the power of browser automation with user-friendly tools like Clickermann. This software automates mouse and keyboard actions on Windows computers for more efficient brute force attacks. While Clickermann has and is used for entirely legitimate applications, it is also utilized by cybercriminals to facilitate their malicious endeavors. This is often the case with other software applications.
- Automated brute force processes allow cybercriminals to target numerous VPN endpoints simultaneously, dramatically increasing their chances of discovering valid login credentials. Browser automation’s scalability empowers them to cast a wider net and cover more potential victims in less time.
- Fortunately, following well-documented and established best practices such as multi-factor authentication (MFA) can prevent organizations from falling victim to most VPN brute forcing attempts.
Browser Automation
Many threat actors rely heavily on browser automation 1 when it comes to brute force attacks. Automating interactions with a browser includes tasks such as navigating to specific web pages, filling out forms, clicking buttons, and collecting data from web pages. Browser automation is commonly used for testing web applications, web scraping, and performing repetitive tasks on websites. It can save time and reduce the risk of errors when compared to manual interactions with a web browser.
Many threat actors are not necessarily very high-tech savvy, so to make the brute forcing process even more efficient and easy, many of them also take advantage of some of the many browser automation tools that are available. One such popular tool is called Clickermann, a software that can automate mouse and keyboard actions on a Windows computer. This software is used to record and playback macros, create scripts, and automate the repetitive task of loading specially curated, large word lists into the UI of the VPN the cybercriminal is trying to compromise.
Through automated brute force processes, threat actors can efficiently target numerous VPN endpoints simultaneously, significantly boosting their likelihood of discovering valid login credentials. The utilization of browser automation further enables them to scale their attacks, covering a wider range of potential targets in a shorter period.
Abuse Complaint Evasion
Numerous internet service providers employ automated abuse complaint systems that activate whenever they detect sudden spikes in network traffic originating from external IP addresses. This situation often occurs during brute force attacks, where the attacker is coming from an IP address external to the hosting provider’s network. This attack generates a sudden surge in attempts to breach a VPN account, for example. To evade these automated abuse complaints, cybercriminals conduct their attacks on a large scale, simultaneously targeting hundreds of victims across dozens of providers, such that the amount of network traffic per device is far lower. This turns traditional brute force attacks upside-down; instead of hammering a single device continuously, threat actors attack many targets simultaneously, attacking each individual target at a lower rate, but attacking a large number of targets at once. This strategy reduces the level of activity on each individual IP or VPN endpoint, preventing them from being identified as suspicious and triggering abuse complaints.
The Clickermann tool is also advertised as being extremely easy to use and not requiring a lot of scripting or programming knowledge, which makes it even more appealing for low-tech threat actors and script kiddies 2 .
The instance a successful login occurs, a prompt to download the actual VPN client appears. This is the sign for the threat actor that a certain set of credentials was valid and can now be used to log in to the VPN client.
Safeguarding against VPN exploitation
As outlined in the initial and second entries of our blog post series, the subsequent recommendations encapsulate best practices that organizations can adopt to fortify themselves against VPN brute force attacks and the potential exploitation of compromised VPN credentials:
- 1 – Secure the network perimeter by rejecting traffic from scanners such as Shodan and Censys 3 , effectively blocking all associated IPs. While this measure may not deter threat actors who manually scan the internet for potential targets, it will successfully conceal targets from those who heavily depend on these scanning services for identification.
- 2 – Implement robust authentication with multi-factor authentication (MFA). By requiring users to provide multiple forms of identification, such as a password and a security token, accessing the VPN becomes significantly more secure and resilient against unauthorized intrusion attempts.
- 3 – Enhance VPN client security through restricted download. Ensure unprivileged users download the VPN client exclusively from a secure webserver, minimizing the risk of compromise and providing an additional layer of protection to the VPN application.
- 4 – Maintain up-to-date VPN software: It is imperative for organizations to consistently update their VPN software, ensuring that any vulnerabilities are promptly patched and mitigating the risk of potential attacks.
* Disclaimer: This document is provided ‘as is’ for informational purposes only, without any warranties of any kind regarding any information contained within.
2 A term used to describe a person who uses pre-written scripts or tools to launch cyber attacks, without any real understanding of the technology or methodology behind the attack.
3 Shodan and Censys publish their IPs online. Guides on how to block them can be found at https://wiki.ipfire.org/configuration/firewall/blockshodan and at https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Scanning.