On January 11, 2022, millions of gamers worldwide prepared to purchase Sony's PlayStation 5 during a major US retailer's restocking event, over a year after the console's initial November 2020 launch. Within minutes of the sale going live, legitimate customers found themselves locked out, watching helplessly as inventory vanished before they could even load the purchase page. The culprit? An army of sophisticated reseller bots that bombarded the retailer's "add to cart" API with over 27 million requests per hour, representing 200 times normal traffic levels. In the first hour alone, 99.2% of all purchase requests came from automated bots, not human customers. These bots exploited the unprotected business flow to acquire inventory at retail prices of $399 to $499, later reselling consoles on secondary markets for up to $1,000, effectively doubling the original cost.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Unrestricted Access to Sensitive Business Flow

  • Roman Canlas

摘要

On January 11, 2022, millions of gamers worldwide prepared to purchase Sony's PlayStation 5 during a major US retailer's restocking event, over a year after the console's initial November 2020 launch. Within minutes of the sale going live, legitimate customers found themselves locked out, watching helplessly as inventory vanished before they could even load the purchase page. The culprit? An army of sophisticated reseller bots that bombarded the retailer's "add to cart" API with over 27 million requests per hour, representing 200 times normal traffic levels. In the first hour alone, 99.2% of all purchase requests came from automated bots, not human customers. These bots exploited the unprotected business flow to acquire inventory at retail prices of $399 to $499, later reselling consoles on secondary markets for up to $1,000, effectively doubling the original cost.