all right let's get started
poking bots for fun and profit uh in the
age of asynchronous stuff it's
it's quite a long name uh but
yeah my kid said this is a very long
um title uh
that and i i kind of agree
let's see all right let's
uh just a little bit about myself
um you know working a security and
financial
industry for like over 10 years um
really that that's that's some that are
some experience
there but there's a friend of mine told
me
a few months ago i really nobody you
know
just trying to get a research done
and working the the indus for a couple
of
years you know fascinated
you know why uh wife kids you know
and authentication systems and disorder
otherwise she's gonna kill me
um i'm really interested in the machine
learning behavior analysis
i'm stronger believe about the
programmers and you know research will
rule the world so
i i'm true believer that
programming skill is a very foundational
skill across
all technology areas and
that's it i think this is very important
um just uh as a
last independent research work i i had
this cv
um from their uh think of assistance
publish it
and this is just part of the you know
things that i try to do
inside and in parallel to everything
else well that's that's pretty much me
um uh the goal of this presentation i i
just uh to give this an introduction why
i got here and this
particular this research a few years ago
was working up a machine
learning module in order to to fine
tuning some false positive that was
getting from a supervised mode
so was i was building a system that
would
combine supervised and unsupervised
modern
and it would send me a message over
telegram
to uh tell me what you want to do with
this alert is this something
is it uh do you want to mark it as an
unsupervised
or you know how do you want to to handle
this situation i want a very quick
feedback connect
i would like to interact with it
anytime anywhere without the need to get
into system and do anything
so and that that i developed this bot
and then i realized that okay there is
an input there
it's a menu on the on the telegram that
you just click and say
one or two or three or doesn't matter
but
the point is there was some input there
and then when i was looking at the
source code they said well
if diagrams allow me to send some sql
injection screen
it could potentially be exploited so
that that that's what they start and
after a few months
i i started seeing a lot of uh you know
especially small business trying to
build
their business model on the top of those
you know cross-platform things like
telegram and the others uh because
seeing this as a
like a cheap way of deploying frameworks
and front-ends
in platforms that they wouldn't reach if
they were going to
to deliver like to develop application
by themselves like
through android or to ios
so to apple store things like that so
i i found it interesting start research
on telegram bots
and extended a little bit to other uh
bots as well
so the idea really is to raise the
awareness
regarding the ta secure tests on those
bots and
apps so some some platforms call it
outbox other apps but essentially all
applications
and integra integration application that
can i know
uh tap into internal systems and bring
things to the surface of
those those uh communication platforms
and i want i really want to share the
challenge of testing this kind of
application
uh and try to set some some direction
for whoever is
is going to try it or is trying it
currently and
of course shed some light on the
strategy on this and hopefully
motivate companies include those kind of
apps and
their you know by hand like bounding
problems so
i haven't seen those explicitly on the
polis
so perhaps we can change that
uh and of course no this is not about
vacuum cleaners right that's they're
they're vulnerable but
i guess nobody cares and
what does those bots and apps are use it
of course
uh where can you spot one if we start
from there so
the score is like telegram hangout all
those guys support bots today
right facebook our app uh principal
communication apps are supporting those
kind of things and then
they came up with this concept of other
people's
program or building applications on opp
which is other people's program and
other platforms
that allows you to build your own
software or
program there and then put
make it available in things like
marketplace and
and uh and on other things so that
that's
you can spot everywhere bots are
everywhere to all kind of integration
you can call it bought or not
integration apps are pretty much
something that you can call it what they
do
is they do a process data
and conversation and chats and file
right that's all those things that they
eat i used i used to say they eat all
those things and what they
do with those things so they can do a
lot of things if you add a bot to our
conversation
in a group you can you just be aware
that
this bot will probably have rights to
read all the masses and
store it internally so from private's
perspective better be
careful when you deal with a bot in your
chat so yeah they do a lot of things
right
chat group they provide quick response
they tap into internal systems that
give give you a quickie answers i i like
say if you
were in a conversation a group chat and
say i would like to
to know the budget from you know
five years ago we just go but budget
year and it will just
you know bring it back to you without
the need to open a system do something
the information that is
something that you need at the time and
it's much faster you can
do a lot of quick quick wings right
there
so and you have a lot of uh samples out
there you see antivirus
working in a group chat to to take care
of
files that uploaded their urls
to avoid phishing and things like that
and and some
businesses are building like in from
entire frontiers to
um to to offer clients and and
and other third parties integration with
their products
so it's really uh uh uh
on a growing um uh
privacy in the the industry
and well i think one important message
to deliver
is that the bots not just a script yeah
it could be if you're just sending a
message from
you know the the a server or just send a
message and not taking anything
back or not listening to what's going on
maybe but most of the time it is an
actual application and
it is connected to like multiple system
interacts with
with the users and systems and and
everything so it's an actual application
and it needs to be
secure tested um i let me touch base on
the
some common architectures because i
think this this is helpful for us to
understand
so uh the there are
different ways you can implement those
those uh bots but
you the way you see really see this is
likewise in web sockets and web hooks
uh you all see like a regular web base
but it's very here right now because
it's so it's so
uh unresponsive and not very fast
and like regular web base that is like
you pretty much
are searching uh you are looking at the
page the page gets fresh at like
every second two seconds per second and
then you have the
bot sensor there which is not really
what we've seen today in terms of
technology so web sockets is
pretty much ruling those things and web
hooks
so and you have a mix between
mix and http sometimes you send the
requests over http
and you receive the response through a
webhook
or a websocked right so you have
two ways websocks you post message to a
webhook waiting point
endpoint and then you receive through a
webhook endpoint so we'll go
a little bit into this uh in the next
slide
so you pretty much there is a there is a
different
way of doing this you can use like
pulling which you're constantly asking
for updates
right you are constantly uh uh asking
for updates
like is there an update yeah is there an
update and i say no
no no all day long if there isn't but
at some point if you have an event that
you are interested
it will say yes there is here it is the
the update
but this this is a very expensive
mechanism from that perspective and it
is pretty hard to scale
if you're implementing a corporate
enterprise environment
the web hook though your bot is only
uh uh only receive the message
when there is an event that i interested
on
so let's say you're about subscribed on
any message
so when you have an old message event on
the platform
you will receive a post post request and
a web hook what is a web hook and
web hook is just a end point that your
bot
has access to and it received data
through it
right uh so it's pretty much a web
service
endpoint that the platform is configured
to call
whenever there is a method that is
interesting for you
that's that's pretty much a webhook uh
technology and then you also have web
sockets websites pretty
pretty neat as well uh you
you see the implementation using either
website
web sucks for everything message control
and also send and receive the message
message control is like you know when
somebody is typing another end
or there are some signals that they send
be
in between two conversations in the chat
that this is is there
uh and also like the sequencing number
id is to know which message comes first
and organize those things and then the
front-end glue together of those things
and organize how it's gonna
show and you have a mix of web socks in
the way it's the proposed as i said
before
you send a message over i http post
right to the channel uh using an api
and then you pretty much receive message
control and the actual message
that that are in the chat you also bring
it you receive it through the websock so
this is another model
so just to to fly through some uh
weaknesses
of the web hook and callback
implementations
so a web hook is supposed to be a kind
of a web score url
that you configure on the messaging
platform so that this master platform
you call your bot your website your
endpoint
um over the internet in order to
uh deliver a message or whenever there
is an event right
uh so most of the time this is like a
hidden world nobody's really
should know about those things and and
therefore
nobody reach out to it because it does
they don't know so there is an obscurity
there that you expect that
okay nobody knows israel nobody's going
to reheat it
but that's probably not the case most of
the time
so you do configure this role with
whatever it requires and then it send
the post data to our web hook
uh every time there is a message that
your bot is subscribed to
then we from weakness perspective we see
things like no authentication and
international acts
accessible debug enabled and i like
and other things like node boundary
restrictions and cache all those things
contribute to expose this
this this uh um this this web hook
right because it's a endpoint some
platforms do not require authentication
they just suggest you
to protect the vip address and say put a
fire in
and don't accept any connection to the
xerol if you're not coming through
from our ip address may work uh
but there is some you know it's a
suggestion there is no enforcement
from the messaging platform for you to
do it you do if you want to right
internet accessible is is like if you if
you have this open up
open it up on the to the internet it you
may
be you can be reached for it by anyone
and if you don't have authentication
it's open to the internet
well you can be your your your bot can
be attacked
right essentially the bot can receive a
message
from anyone on the internet uh
pretty much that's it without going
through the mastering platform
if the bug is enabled that makes the
life very easy if you get a
some a very like a lot of debug when you
send a post request they will
regurgitate all the the
fields and things that is wrong are
missing that that helps a lot
and at potential attacking potential
autobiographies restriction helps when
you have like a soft uh
ssrf like server side requests for your
vulnerability so that makes the life of
attackers much easier as well
and of course like things like obvious
names and exit caches and
search engine engines are help you to
spot those things on like in search on
google bing index like that
right so all those things make makes
your or your
web hook more exposed and vulnerable
so when we're attacking those things and
talking about sticky from the secure
test
the testing perspective
when you're testing a regular web
application still
you're really really dealing with a
request
response sometimes web socket and then
it goes a little bit
different there as well but essentially
when you talk about all those bots you
have all sort of different
schemas technology protocols and
things that happens inside that you need
to be aware
even to send off one request if you want
to customize
one request or one message to be posted
to the the the messaging platform you
need to deal with those things
like i'm just uh mentioning a few of
them
things like mt prot that needs to be
handled on the
on the telegram side which is a not
it's not http based protocol you need to
tackle this
and other stuff that happens there even
id serialization
it hm message has a one id a different
id that you need to make sure you are in
sync
otherwise your message is going to be
ignored so there are a lot of things
uh a synchronous of course you send a
message there is no guarantee that it's
coming back
that's one secondly if the message
coming back
it doesn't come back in the same
response it comes back
in form of other things like it comes
through a web socket or things like that
so it's not
the same as testing a regular
application rating limit is
like but those platforms in forests are
limiting the number of master that you
send
how fast you send and all those things
and you can get your account banned if
you
go too fast too soon um
another thing to to interesting that you
need to consider is like understand the
rules of engagement because
this is important when you try to
automate tests and i think
the it bounced out to be the case here
or talk about most of the how can
automate tax again those bots
um and penetrate tools and techniques
that we use in other words
here inside this one and things like
bot versus bot is something that you're
not supposed to do in telegram
right not supposed to do and uh uh and
is lack is fine
so these things you need to consider
when target a bot
what is the situation which are the
rules of engagement
how should i proceed
so from attacking approach perspective
you have like manual tests on message
from
which is fine but the focus here really
is on the trying to automate those
things
right uh manual test is fine you go to
web chat and just
start typing things you know like normal
pattern person do
and you can do this as that but the
automation is like
the challenge here and automated attacks
on the web front end you can do using
things like
selenium or cypress cypress is very
powerful now
to to to perform uh end-to-end tests
and you can divert this and use for
security as well
um which you use a web front end so all
those those
uh messaging platforms they do have web
from 10 today it's
it's not really common to see one that
doesn't have
make use of the message platform client
api some of those platforms
provide you with a client api to empower
you to create your own client you can
use this api
to interact with the flat platform and
say that you
are building a security client
tool with scanner whatever to test
applications for this platform
uh use a bot to test your
target bot so it's a bot talking to
another bot
it's a very interesting approach as well
the idea is
to automate certain task criterias and
then
add those two bots to the same room and
land one test another one
right that that's one approach as well
create a wrapper uh
around the api to allow other security
bots penetrate the masking platform
and read the bot that's very challenge
so my my suggestion is
it's you you need to mock things up to
make some
response reliable and needs to be
customized for
every single test
that you're going to perform against a
certain target
so you cannot just okay let's just wrap
it and run it
it's not going to happen there's a lot
of tuning there
especially when you were trying to use
some time based
payloads which might not work most of
the time
so and generate false policies uh
okay another things to consider is like
regular web security scans may not find
anything upfront
the same reason is a lot of you first of
all
track the response based on the request
is challenging
uh it does requires fine-tuning you need
to check things
i said in the slide before you have
things like
the ids and you know sequence you need
to control all those
those variables in order to have your
message accepted by the messaging
platform
and flows through and reach out to your
bot so
be aware of those things as i said
earlier time-based payloads
may generate a tons of false policy
because this is an asynchronous word
and there are synchronous words you send
something you may
get something now as i answer you may
not
or you may receive in a different
channel so
the outcome of the method that you send
it's not always as you expect and if and
if there is an errands
on answer you don't know is there so you
don't know if
a error occur
you don't know if uh something
you know went wrong or if just decide to
not reply to you
or if it was something that got lost in
the middle so it's it's hard to track
the answers there
that's pretty much the synchronous prior
time right the still response time is
not constant i was getting ahead of
myself but that's pretty much
it payloads may have response sometime
later
right debug message hardly go back to
the user and that's important because if
you're testing about our integration
application
it there is like the developers and they
need to be very creative
to like to send back an error message
from database
to a chat a platform
in the chat room it's they have to be
like very creative
so it requires a lot of effort to do it
i mean
this needs to be very creative let's see
so analyze how this this is very
important to analyze what the bots do so
if you have a target a bot as a target
you need to analyze how this bot
interacts with people
bots and other chat like if it
mention users when replying or if need
to be mentioning
when you're sending some when you send
some message
right you need to understand what's the
entry point
when i send a message to this chat does
this bot just pick it up and do
something
or i need to engage the bots say hey but
does this to me and things like that
because that will drive the
your model's operands in your attack
those it is commands so it's very common
to see things like
slash something liking you know discord
even in the old
irc which was very common to use there
uh interesting thing is can i add my bot
to the same channel
or i can i i add the bot to
my own channel so those things may may
play
around my strategy to see what how to
best approach
this this target so make sure
you reach the bot with the intended
payload
you send a payload you need to make sure
it's not getting butchered in the
between
sometimes it does happen so you need to
check if the platform you're testing is
not restricting certain types of
characters
it it's tricky sometimes because
you need to understand if you're using a
high level api for example the api might
be throwing errors without even
communicate to the backend so you need
to determine if it is api or it's a back
end
where the validation happens things like
that so
that's kind of a trick and need to debug
debug
and follow rules and protocols required
by the platform so as i said you are
playing with somebody else's rules
in order to to reach out to the target
bot so if you don't do this correctly
it will zap your communication to the
bot and you will not
read the bot so you need to have that in
mind
that there is a middleman there um
taking the message
and looking to what's going on
protections may be in place so
web application fire could be protecting
the web hooks that's that's an approach
that's an interesting approach you can
have it there
ips maybe come protect the communication
from to the target bot
as well doing some sort of ssl of
loading and
you know tap into the communication
target bot might not
interact with other bots so this happens
if some platforms don't allow it
but when it is allowed the developers
choose to
not talk to other bots in order to
protect from
spawn spans and things like that right
from attack perspective so let's see the
exploit opportunities of course
once you pursue this veil you
have other possible all the
possibilities are in the table right
file uploading processing is very common
among uh bot applications so you see
those things
all the time bots having these
functionalities url
parsers and ssrf attacks well pretty
much
if you look at the presentation uh which
is like
make it make ssr a great again from
from the past conference you see how
many possibilities there are there
to bypass your past so they are
all in the scope database interactions
try to figure out which
uh uh functionaries from the bot might
be interacting with
database there might have protection
functions that it can automate inside
brute force
you know things like that enumeration
and you have like reports been generated
here and there
integration with apis things like google
docs and other things
trying to uh modify documents remotely
to include malicious code things
like that can can be do and eventually
get some remote code execution if you're
lucky
right so many possibilities there
now uh i just want to touch base a
little bit on this
software developer site and automation
which is kind of
the point that i want to to get here is
like secure automation through ci cds
vibe line first of all
those applications should have all those
because this is not
just a script as i said this is a actual
application and you need to test this
totally
as you do with another web application
or any other application
right so that's if you have a assassin
sca all those tools that cycle to in the
pipeline
go for it though though those will be
very helpful
now for dust if you're using like a
dynamic
uh scanner like uh you know burpio asps
up things like that
you may may need a little bit more you
need to you may
consider expose a web hook just for
those tests
uh to make sure input validation
authentication those things are working
properly and then
you can actually test those either
manually or
scanning automatically use api or bots
to test for
uh and for secure checks known to be
important if they're like
things like you have unit test
integration tests
put there some customize the attached to
pre-perform
every every time again to make sure
nobody
put everyone at a bill like that like
something very obvious and things like
that
so consider your cypress i wouldn't
still any web drive is
probably possible as well but cyprus is
a very modern framework to test
that like use it for for end-to-end
tests and which
is a is very good too consider that
because you can use it
against the web ui and you don't need to
do
anything else though you can use cypress
with the web ui directly
respect the limit f when automating
otherwise your account can be banned
blocked things like that don't don't go
too
fast against those those things uh keep
in mind this is an external environment
like an opv you don't have control over
it
and that's pretty much what i i i had
for it before the demo so let me
just uh quickly show a first demo
this demo is um
pretty much we have here
two bots in the same room one bot
implement a function which is zeus zeus
is the bot that implement the function
and and aton is the bot that's going to
exploit this function on zeros
so what you see here is lag open and now
i just
uh started zeus application and you can
see
slack calling the web hook on zeus
sending
a pretty much posting uh events that
happened in his lack while the bot was
offline
which is pretty much those dogs that you
can see there those dogs are pretty much
been posted
on this black and web who
buys lag in our web hook and end points
now let's just take a look how the zeus
bot works what this does is you send
a message like invoice and reference
number
and then zeus comes back saying that oh
this is the company and this is the
amount of this invoice that's pretty
much
just to to to to true it's just an
example on how a
a vulnerable application would work so
in this case i have the number of
invoice that is valid
and it says just to demonstrate how it
works so you have the name of the
company
and then you have the amount right so
if we try to do a sql injection for
example right because it's
it's clear something that is bringing
something from potentially a database
or a web api but what what happens if
you try to do a simple sql injection
here
if you look at the debug of processing
on sales
you see that uh the query are logged
there just for
for us to understand what's going on the
back end and the first
query it goes okay the second one though
only shows one
it doesn't show r1 it goes on that
happens because it's very common on
bots too uh in
to ignore space no it's not at the
ignores
it pretty much splits every space is a
new command
or it's a new parameter sorry it's a new
parameter for the command
so invoice is the command one is the
parameter
right and r becomes another one that's
why it's ignored everything because it
takes
just the first parameter now what we're
gonna do is
we will run aton atom has a few payloads
sql injection payloads and it will try
one by one
to see what's going to happen first it
send
the baseline payload which is the one
that is true
and then initiate with six payloads and
send one by one
you can see on the zeus uh screen
that there are many errors in the sql
right my sequel
is just throwing up the errors because
those
queries are reaching the bot and the bot
just trying to execute the query so we
are interfering the query
until we so the atom as a bot send
a string that actually
pierce through and make sense for mysql
and
make the the bot uh print out all those
those companies and their invoice
amounts
as you can see uh it it send one there
is no response
another there is no response no response
no response
but when i when we use and see only
thing that we did
the difference from payload one and the
the the payload
six in this case was that we use it
instead of space we use comments on on
in case of on mysql and then it went
through
and then of course we made the sql
injection happen
and the bot just printed everything that
came back from the
from the database so that's it
a single injection between two apps on
slack one bot attacking
another bot pretty much on a slack
now the next demo is uh this is telegram
demo
so telegram uh let's see how it goes but
this is pretty much a registration code
and we and we use a cli telegram client
to attack telegram bot in order to
enumerate the right
registration code it sends
a few codes just just to automate and
show how the automation works
and you can see that please verify it
again
invalid registration code over and over
again
until you get an actual code that
works and in this case i know what to
expect when it accepts
but but at the same time i know what is
not acceptable
right i know the end her message so i
can automate this process
and make it happen so this very much
this this tool is
will be available on github by the time
the presentation is up
and this is the end of the presentation
this is it
thanks so much connect with us in the
discord we'll be answering the any
questions
alright thank you