Social Media App Prevents 300M Spam Attacks a Month with Arkose Labs

Overview

One of the top 10 most downloaded social networking apps was receiving hundreds of millions of spam attacks every month. The app was favored by many for its largely unregulated registration web application, which preserves user anonymity by allowing accounts to be registered without a telephone number being provided. Spam had become such a significant problem for the app that it introduced a new team of specialists dedicated to eliminating the problem.

The Business Problem

Abuse was primarily driven through high volumes of spam messages that targeted users with phishing attacks, inappropriate friend requests, and other activities that ultimately lured users into sharing personal financial information. Attackers monetized these spam attacks by automating their operations to achieve economies of scale.

The ongoing problem placed the app under intense scrutiny. Automated spam attacks had become so frequent that the app measured a month-on-month decrease in user acquisition. Numerous unsuccessful attempts at stopping the attacks meant that customers had increasingly negative perceptions of the app.

reCAPTCHA, ultimately proved incapable of stopping automated processes from exploiting the app, and frustrated legitimate users. Attempts to manually block questionable users led to extensive false positives, with many abandoning the app after being misclassified as inauthentic. Custom defenses, which were built in-house, also provided little long-term resistance to attackers, who were continually changing tactics and investing more resources to overcome the app’s defenses.

The Arkose Labs Solution

The company decided to deploy Arkose Labs in order to identify risky activity and use interactive enforcement challenges to intercept spam. Arkose Detect, a sophisticated risk engine, worked in hand with Arkose Enforce, a challenge-response system to provide targeted friction.

Attackers made a number of high-profile attempts that sought to bypass Arkose MatchKey challenges through automation, but the system remained uncompromised and was able to eliminate automated attacks. Therefore, attackers were forced to shoulder untenable operational costs that would not yield a return on investment.

Frustrated by their failed attempts to automate a work around, attackers operationalized digital sweatshops, where human users are paid to remotely solve hundreds of authentication challenges per hour. This activity has many distinct characteristics that are clear telltales, and Arkose Labs was able to intercept such requests to appropriately classify them as inauthentic.