The Right to Buy Tickets

Young people waiting in line to buy tickets in NewYork.

With President Obama’s signing of the Better Online Ticket Sales (BOTS) Act of 2016 and the passing of recent legislation in New York, there are signs of hope that beginning in 2017, humans may once again have a fighting chance of purchasing a ticket to a hot concert, show or event.

It took ticket prices reaching $1000 per head for the award-winning Broadway show “Hamilton”, to force action against ticket bots getting the best seats in the house. Lin-Manuel Miranda who created and stars in Hamilton wrote a compelling Op-Ed in the New York Times in June 2016 entitled “Stop the Bots from Killing Broadway.” Finally, in December New York Gov. Cuomo passed a bill to make ticket bot purchases illegal. As one of the founding fathers of the US Constitution, it seems that Hamilton would have approved of an amendment that protected “the right to buy tickets.”

So how did ticket bots get control over the ticket purchases? The cybercriminal ecosystem has evolved over the past few years to make it easier to launch automated attacks on web and mobile apps with the purpose of stealing assets. In the case of ticket bots, automated scripts running on rented botnets enable the immediate and rapid purchase of tickets to popular events once they go on sale. Humans don’t have a chance against a machine intent on purchasing tickets. Until now.

With the recently passed ticket bot legislation, it is officially illegal to use ticket bots with the purpose of automated purchasing. Now ticket sellers  are protected against fraud by state fines and possible jail time as a deterrent.  With this new legislation, ticket sellers must also tighten up their defenses so that they can prevent the use of ticket bots proactively. Just stating that the use of automation and ticket bots is not allowed will no longer be sufficient as a defense.

Enforcing this legislation will have some challenges given the number of parties involved in automated ticket purchases. The illegal ticket reseller is in many cases at the outer edge of a cybercriminal ecosystem that is rapidly building out infrastructure and services on the Dark Web. In addition to automated ticket purchases, automated credential stuffing attacks for account takeover and malicious content scraping are affecting retail, travel and ecommerce businesses. The threat of fines and possible jail time for ticket bots will hopefully go some way to drying up some of the demand for cybercriminal automation.

Shows such as Hamilton were created for humans to enjoy, and at Shape Security we believe consumers shouldn’t have to fight bots to get a ticket. Every day at Shape Security we help major companies defend against automated attacks by bots, and we applaud this new legislation outlawing ticket bots.

Avivah Litan at Gartner: Impact of Automated Attacks on B2C Websites

Avivah Litan, Gartner VP and distinguished analyst, is well known for covering big data analytics for cybersecurity & fraud as well as fraud detection & prevention solutions. In this educational webcast, she discusses automated website attacks and their impact on global business to consumer (B2C) brands.


Refer to this link to watch the videos.


Key highlights include:

  • How Gartner defines automated attacks on websites
  • How existing controls, such as device analytics, velocity checks, geolocation, and IP address whitelisting are defeated by attackers
  • How cybercriminals monetize their automated website attacks
  • And, most importantly, how to stop automated attacks

5 Things We Learned At RSA

1. KBA and NSA are shaping tech startups

General Keith B. Alexander, who retired as NSA Director in 2014, has become the founder and CEO of a new startup, Ironnet. During his RSA session this year, he talked about how to heal the wounds to the tech community and what gift he’d send Snowden if he were given the opportunity. For the tech community, he recommended classified briefings to get technology companies the facts. For Snowden, he said he would send him the oath, which was met with loud applause from the audience. Take a look at the FCW article here.

2. Breaches are happening, even during RSA

On the 2nd day of RSA, a major hotel chain notified their 18 million members via email that their accounts had been reset out of an abundance of caution. According to us at Shape, it seems possible, even likely, that account checkers had been used to hijack 200 accounts at the hotel chain. Take a look at the Shape blog post on account checkers.

3. Taking security up one level – to the Board

Everyone seemed to like and agree with what was said at the presentation, “A CISO’s Perspective on Talking to the Board about Cybersecurity”. See what WSJ wrote about it here.

4. Password management is hard

Shape’s own Zhiwei Li spoke about password managers, exposing several vulnerabilities (now plugged) and discussing which manager would be the best manager in various cases. Take a look at his presentation slides.

5. Botnets are alive and well despite takedowns

Botnets are alive and well, despite takedowns. The federal agencies behind the takeover of a major Zeus botnet (12 governments, 13 companies, 4 non-profits and 3 USG federal agencies) said the criminal enterprises have learned and adapted to build more sophisticated and evasive botnets. Check out the list of agencies involved on the RSA session summary page.

It was a great show for Shape Security. If you go to a lot of conferences, like we do, then we’ll be seeing you at Blackhat in Vegas, and again at RSA in San Francisco in 2016.

Use of Stolen Creds Is Most Dangerous Web Threat, Verizon Finds

Use of stolen credentials is the biggest web threat, says the most recent Verizon Data Breach Report.

Learn more about this threat below.

A working definition of the use of stolen credentials is available on an OWASP page. The occurance of stolen creds rose from #7 in 2009 to #1 in 2013. 2013 is the most recent data. Here at Shape Security, we hear about stolen credentials, credential stuffing and account checkers every day. We’ve also blogged about what Gartner told us. According to Gartner’s fraud expert Avivah Litan, “clients have reported a significant rise over the last two months in the use of stolen credentials to access accounts”.
Contact Shape if you would like our help protecting your site from the use of stolen credentials. Our technology blocks account checkers, credential stuffing and other automated attacks.