Enumeration Attacks
Discover patterns of malicious enumeration in API traffic and take action by rate limiting, blocking, or sending a deceptive response.
Enumeration and Snooping Attack
Automation allows a bad actor to launch enumeration attacks directly against the application APIs as shown in the Prying-Eye vulnerability where a bot cycles through (enumerates) and discovers valid numeric meeting IDs. If the common user practice of disabling security functionality is followed, then the bad actor would be able to view or listen to an active meeting.
Targeting the web conferencing application APIs directly, this attack (1) uses a bot to enumerate and discover the numeric, or alphanumeric identifiers that (2) perform the attendee access control function. If the application is not protected by a password or other authentication mechanism, (3) the bad actor can surreptitiously gain access to the web meeting.
Gift Card/Check Enumeration
Enumeration Attacks are often used by bad actors to validate and use gift cards before the real owners are able to do so. Bad actors can easily determine the numeric sequence by viewing the cards on display in retail stores. Armed with the numeric pattern, a bot can be programmed to validate the card numbers. In some scenarios, a bank validation is required prior to use, and if successful, they can then be used immediately to make valid purchases.
