So, hey, I'm Ryan. I help tokenize K-Bot Birmingham. I am a Bromie. I come from Birmingham
UK, not Alabama. They get the mixed up. I've got an unhealthy obsession with programming
mascots and there's my social. Thank you very much for please top of flying me out
here today. I've just a disclaimer before we start. I am not an expert on anything that
I'm talking about. Take everything with a pinch of salt. And I'm here to give a talk
today about this thing. Who recognizes it? Yes, that's right. This is the stupid auto
dialer thing from the Simpson. That marches down all of the phone numbers. And when
you get a phone call and they go, how are you? And it's like someone trying to get a survey
from you. It's normally one of those annoying machines that have done it. And this kind of
leads us into the problem. In our everyday life we are being bombarded by spammy males,
spam calls and spam advertisements all over the place. A constant stream of it. And in a very
similar way our lovely little server here is also being bombarded with a constant swarm of
annoying bot traffic. Bots will literally just mock true IPs. One, two, three, four, five, six,
seven, eight, nine. And you can do the entire four billion IPs available in IPv4 in quite a short
amount of time surprisingly. And if you've ever had access logs on your server and you've seen,
hello can I just please get the dotty interview file? Please please can I have something? Please please
let me in! Yeah, very annoying. And it's not just one bot. It's thousands of bots. And
now we're all coded for different frameworks, looking for different things they can poke. And it
only requires one bot for your server to be very sad. And they don't take a break. If you're,
you know it's 3am and you get a call and they go, why is the website being replaced with
some dodgy third party thing? Tough, got to fix it, bots don't sleep so that you can't either.
And it's not just on the HTTP protocol, they will come on any ports, you know, FTP DNS as
them to any protocol you can imagine there are bots loitering around the IPv4 space trying to
poke and prod. So what can be done? Well I'm glad, you asked. We can do this.
I can you just just go right now. All right did that actually kill my, I don't kill my
clicker. That's amazing. Oh well, I'm starting to go right in
I was sorry. It was worth it. Get back into shape. So yes, we can do all of these
very interesting things. Take a picture if you're interested. You've got six
seconds, five, four, three, two, one. Time's up. Questions up at the end of my
talk. Thank you very much. Oh, no. Wow, that's a bit boring, isn't it? Is there
something to keep it more fun? We could do. Well, there's a very similar
problem in the cool space where, you know, you get spam callers. And there's
very interesting YouTube channel called Kit Boga, where he will make himself a
big old target and try and keep the cooler. spam caller that is on the line
for as absolutely long as possible. And that gave me an idea, which leads us into
beginning the bamboosling. I can see if I can not this, because of maintenance
now, okay. Honeybots, we love honeybots. They're good. And to me, honeybots are made of
three kind of good components. You have the honey, the honeycomb and the pot itself.
With the honey, well, the honey is kind of anything desirable to a thread. I didn't
worry this thread. Look, you can get a picture of me with the type of a
threat actor looking for desirable things like api keys and things. So what to
do? Well, there is this lovely repository called GitLeaks, which contains pretty
much every last single secret definition you could ever imagine or dream of
having in, in Redgex form for searching through repositories for a static
analysis that you don't commit them accidentally. And these redgexes are
quite interesting, because there's another nice little tool called goregen, where you
can generate random string from regular expressions. If we just put these two together, do
we have an infinite supply of a free secret to give out. Oh, that's wrong, I think isn't
it. Which leads us onto our honeycomb. We have structured data, bots like to
read structured data. And we have this amazing thing called JSON schema, which allows
us to define structured data in a way that we can validate it. And there is a nice JSON
schema store with all of the major configuration files that you can get on the internet.
And there is this magical thing called JSON schema faker, which allows you to generate
random data, how exciting. But there's something hanging out the bottom of it. Oh,
this will go for it's a JavaScript library. Everything's written in JavaScript. There's
nothing we can do. Time to go. What is this? Wow, it is GoChap, which generates random
data for a given schema. Oh, my god. Because why spend five minutes trying to convert
the JavaScript library, when you can spend three months doing a site project? That was
fun. I do not like JSON schemas. And with the power of these four combines, infinance
secrets and structured data, the joys, which brings us onto the bots, which we want something
with a very small prop friend that's very nice and you can run. Yeah, I use Go. Don't
shout at me. And if we lob everything that we've collected here together, we get go parts,
which is what I'm talking about today. Let us start with maximizing the misery. Who knows
what this is? Got five, four, three, two, one. It's a slow, Laura's indeed. Congratulations.
I think you get the idea of where this is going. So for those who don't know, a slow
Laura's is a type of low and slow deed or attack, where you open up a connection to the
server and then go, I'll open up a connection, what you're going to do about it. Oh, no, no,
another connection. I don't know, another few more connections and just not really just send
a few bytes of data. And I hope you'll hit a threadball a bit and the server will die. But
I thought what happens if you just turn this on its head? Well, the bots die? That will
be nice. And this leads into a class of Honeypot's called Papet's. She's a deep and
murky and you can't run around it. This is not an entirely original idea, but the class is very
funny. But can anyone think of any problems with this out of the bats? Six, five.
Did that spawn? The one that I came out with is timeouts. Bots will have timeouts on your
network requests. They won't sit there forever. A lot of the times when you're making an API query,
you're going, oh, it took 15 seconds. It's too long for server must be dead. So, what I've thought to do
is, if a bot sees a bunch of failing requests, it must have taken down the server or something
must have gone wrong. So it will run away. We don't want that. We want the bot to be kept on the
line forever. So if we just wait until the first time out and then infinitely serve,
just about where the timeout is, well then the bot can march as long as it wants and it will struggle
and it will pull an adventure. We'll get away down the bot. But it will have at least have wasted
as much time as we possibly could. And why not let them eat each? They want all of the protocols,
right? They want their HCls and their Dota EMVs and their YAMLs and their XMLs and their Seat Balls.
So, why not if they request for an e-filer on XML file? We just give it to them. You know,
we can serialize data in all the formats that you're wanting, enjoy passing them and enjoy
munching them down. But it's not just HTTP that this happens on it's other protocols.
So, I've been expanding, go pot over the last few months to support FTP as well. So we now have a
file system, and you can download these selections and files if you so happen to fall onto the
loveies ever. And of course, making any requests to this FTP server will be very slow.
You can do one operation a second. That is it. It will wait otherwise. And any of the files
will download at one bite a second for a very long time. Oh, and when you look at this, it's an
infinitely deep file system. Oh, what a shame. Oh, it would be a terrible shame if you were to
try and traverse a file system that will take you until now to the age of the dinosaurs to get on
Anna. Now with more attack surface. This is an app. Cool scan. It's going to all for
looking at what's open ports and you've served. This is a available on your little servers.
But you know, that's what much is it? What happens if we were to port forwards every last
single port available to us on the server to report on go pots? And you know, it's like a duck.
Looks like a duck. It's probably a rabbit. What happens if we connection mocks? And we just add
a long list of available protocols that are funny pot supports and then forward up onto one
to one of the funny pots, if not, so we can support multiple protocols on every last single port
on the server. Good luck, honeypot. Though we don't want to get caught in the crossfire,
there are not all bots about there are plenty of bots that are just you know mapping the internet
retrieving draft database social medias searching your pages for searchers.
Are you really want to you know, smite them well on this kind of approach?
So we've got a robot stock to exceed where you have a user agent, a disallow, and they crawled
away effectively saying who, wearing for how long the bots can do things on at least on the
HTTP standard? And normally when the bots will fly in and they'll be like,
should I go and should I actually deal with this thing now? But then you'll always get the
ones that decide to go away to the pain and those are the people who we're trying to deal with.
Is it legal? Well, I mean, in the UK, apparently not your country, maybe, you know,
I'm not a lawyer, this is not legal advice, but you don't see me if you use the pot, it's not my pot.
Is this moral there? I think it's funny.
The results of this, so I had this, I've got hold three minutes, I've been rocking through these
lives, and so I had this convoluted set up where I did a bunch of AWS magic
leave stuff to pipe metrics around it. I haven't mentioned this yet, but the bots also speak
to each other with gossip protocol and could be running a big cluster, but I didn't think I'd
have time to speak about it. So you can read up with that if yourself if you're interested.
The results are, and I gave that in the time that I ran this across the cluster of
out 10 nodes in mid-2024. I gave out 2 million secrets to bots, so I hope they use those for
useful things, and a total of 23 times of bots sitting there listening to slow tone music
and slowly losing the world to live. What the future holds, well, we've got this nice
pots full for the brim of various tricks and interesting things that we can slow down.
But ideally, it's not just going to be the web server in FTP, I'd like to add data bases and
SMTP, I don't even know what that is, I just copy the bases. Or SSH or Redis, or as many
protocols like in Think of where stalling bots would be funny. As I said, I ran over a lot of
stuff here, there are things that you can do with maximizing the placement of your bots in
a network so you can get hot IP addresses, loads of bots. Also using AWS tends to be quite good
for attracting traffic because people know the IPv4 ranges of these AWS data centers, so they
will match them more often than just generic random IP addresses. There are other things that
need to do in broader protocol support, better telemetry and instrumentation so that people can
look at it. This is part of the T-pot C platform, by the way, so you can run it as a group of the
bots. Ah, one minute run. Well, luckily I want to conclude. Is this actually going to just
stuff all of the bots? But, you know, there are lots of things that you can do to avoid this.
If you just send a few requests, this isn't really going to do much. You can still collect data.
I don't know. Some bots don't give a target to attacks on particular servers and there are other
ways to defeat it. However, it will stop poorly written bots, at least my hope is, it
rated the bar to entry for people writing these bots because it's harder to deal for all the
edge cases and most of all it's funny. Ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah, ah,
credits go to all of these fine people for the ideas and the images, ah, ah, a special thanks to
Irochi Art for all of the custom commissioned gofers because I like proving mascots from the very
keep. Thank you very much for listening with eight seconds to spare and, um, I can now just do
a dance from the last three seconds. That's time. Thank you.
That was hilarious. Thank you so much. It's, uh, much appreciated. Ah, I'm curious
to switch into goling and then go check out your project. Maybe I can do some contributions.
Absolutely. Love any support that you can do with it. Awesome. Have a nice series of it.
You do. Thank you so much. My forward most entertaining talks so far. Oh, thank you so much.