Slashdot Mirror
Researchers Create Social Engineering IRC Bot
An anonymous reader writes "Researchers at the Vienna University of Technology developed an IRC bot that acts as a 'man in the middle' between two unsuspecting users, modifies URLs passed between them, and also is capable of steering the conversation. Not only does this work surprisingly well on IRC — they found a 76.1% click rate for potentially malicious URLs — but four out of 10 people on Facebook Chat also clicked on links after the bot introduced complete strangers to each other. This would have worked even better if the bot were to clone existing friends' profiles and submit friend requests from those, say researchers."
In other words, over 7 out of 10 IRC users and 4 out of 10 Facebook users are utter idiots.
i think i'll let everyone know how we been doing some hacks with bots
bots to scan for vulnerabilities
bots to launch the exploit
BOTS for file sharing
bots to call home
bots to eat my toast...HEY THAT'S MY TOAST
Friends don't let friends click shitty URLs
Aside from all of the fun with malicious code and all, the potential to lead people down a mental path through 'conversation' seems to have the potential to expose a LOT of people to make self-incriminating statements
It's like a photo-radar gun for thought crime, an investigator doesn't even have to be there to do it. Just set your bots out there to lead people into talking about laundering money, seducing teens, killing their neighbor and WHAMO an adventurous district attorney is pressing charges.
Nah, what was I thinking, we live in way to free of a society for that to ever happen. What a relief
Wherever You Go, There You Are
I'm not very impressed considering a billion-dollar industry is founded mostly on sending "the general public" unsolicited links (in broken english, no less) in World of Warcraft that they willingly visit and then volunteer their login credentials.
Can we get back to a world where a person said something after they gathered information on it?
http://www.lectlaw.com/def/e024.htm
A person is 'entrapped' when he is induced or persuaded by law enforcement officers or their agents to commit a crime that he had no previous intent to commit; and the law as a matter of policy forbids conviction in such a case.
Agents in the case being anyone they could pay. Paying someone to bring you criminals is a really bad idea, since any judge would immediately consider the conflict of interest as a cause to have reasonable doubt that the accused is guilty.
I'm sure that paragraph could include a massive amount of legal terms if written by a lawyer.
Reminds me that "magician" who was able to win 50% simultaneous chess matches against any number of professional players.
I did something similar for a friend, helping him pick up women on IRC. The bot learned his usual questions and if they answered about 10 questions, it meant they were interested in him and the bot would forward the conversation to him and he continued it. Another time, I wrote an IRC bot for myself; it would act as a man-in-the-middle to pick up women by getting female nicknames and then forwarding the messages it got to other female-like nicknames it detected. If the conversation went long enough, it forwarded everything to me and I would pick up the chat from there.
Yes, it's sarcasm. Deal with it!
I've seen this idea used for pranks before. People hanging out on IRC watching a bot that was hooking up unsuspecting AIM users to each other. Later on, this became a website called Omegle.
Don't we already have enough biological artificial intelligence on the internet?
Do we really need silicon based artificial intelligence to make the bottomless pit of abstraction consume even more of the internet?
Just because you can blow up an atomic bomb, does it mean you have to?
This is not social networking to use such a bot. its very anti-social and deceptive.
Excuse me but real social networking works on real humans, otherwise its artificial networking.
But here is a thought that might just prove valuable.
Create such bots but program them for this and that philosophy, you know, waring mindset philosophy, Jewish Philosophy, Islamic, Catholic, etc... and let them run on the worlds fastest computers so we can uncover the bullshit of all this in virtual reality before we do it in reall life.
Potential revenue or not...... I would feel like such a lowlife doing this for a living. I don't understand how some people can live with themselves.
For the lulz, about 10 years ago, I created an IRC bot that connected to #sex and #cybersex in dalnet, and pretended to be a young girl awaiting for cyber..
Then it would interconnect pairs of two who would talk to her and forward the message, but this didn't work for long because they'd soon figure out the opposite partner was of the same sex. So i added a functionality that would flip words, example penis vagina, boobs balls, and would intercept some messages (like if a peer requested a picture, or ASL request) and send a fake ASL or URL of a hot chick. After a few attempts, most of the pairs ended up having cyber anyway!
Even though bizarre phrases happened (like "I want to insert my 8 inch vagina into your deep wet penis") most people amazingly didn't even find it strange, and even though it was probably left running all night and created more probably a hundred "encounters", no one even suspected a tiny little about what was going on, no one!
I believe the first artificial intelligence will awaken in botnet.
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
Some friends of mine from uni wrote a shell script to use finger to get a list of users, remove their name from the list, then look up each logged in user's classes (from LDAP, then from the university calendar to convert codes to English), what year they are in, whether domestic or international, and a whole load of other details from LDAP, and present them in an easy to read report. More recent versions try to scrape facebook for mutual friends, interests and so on (and a photo, to prevent name collisions causing embarrassment). When they saw a pretty girl in the labs, they'd ssh into her computer and use the details to provide a conversation starter.
It started out as about 100 characters of bash, and got a little out of hand, but it did work. Personally, I suspect most of the benefit came from the effect of an epic kludge on a CS student than the intended conversation, since it was usually fairly obvious that the suer had a load of her personal information, and explaining that you'd written a script to look them up is a lot better than seeming like a stalker.