the bots they are a-changin'

[iamlost]

It's not Halloween but as I've been playing bot master Victor Frankenstein I thought a good rise of the dystopian machines freak out to be in order.

I expect we've all heard about headless browsers.
Now add machine learning: specifically UCB-ALP CCB logarithmic regret reinforcement learning with a QA layer of inherent KPI to self measure performance allowing a bot to learn, unlearn aka forget, and relearn all by itself.

Note:
* UCB-ALP: upper confidence bound - adaptive linear programming.
* CCB: constrained contextual (multi-armed) bandit.
* QA: quality assurance.
* KPI: key performance indicators.

Want to try identifying it in the wild?
As it is referred to your site by [ Google search ]?

There's a battle outside
And it is ragin'
It'll soon shake your windows
And rattle your walls
For the bots they are a-changin'
---apologies to Bob Dylan, 1964

Why build such a thing?
Such critters already exist.

And sandbox play just might allow (timely) identification.
To maintain competitive advantage.

And
Fight the good fight every moment
Every minute every day
Fight the good fight every moment
It's your only way
---Triumph, 1981

[engine]

I've often wondered why some bots are out there. Primarily research, although some might be there just because they can.

[lucy24]

I've often wondered why some bots are out there.

Seriously. Just how much money is lurking in unsecure WP sites?

[tangor]

As Carl Sagan might have said: "Billlions and Billlllioooons!"

[iamlost]

@engine: I've often wondered why some bots are out there.
Pretty much almost as many reasons as there are bots. Mine is for the knowledge and for the fun :)

Actually, I've come to the conclusion that a great many were built for some reason and simply forgot to turn off; as long as the C&C computer is live the software keeps running.

The most basic ones tend to be academic/research and learning exercises. The more complex ones tend to be scrapers, click fraud, malware. And, I'm reasonably confident, SEs doing due diligence. Basically, the better the bot the more money available so the more return required.

@lucy24: Seriously. Just how much money is lurking in unsecure WP sites?
As tangor says: "Billlions and Billlllioooons!"
Certainly over 2-billion USD per year, possibly as much as 5-billion (click fraud alone). And growing as bots get 'better'.

Two actual scenarios:
* identify, infiltrate, and dump payload, i.e. add site to botnet, add content and link outs to specific sites, add malware to corrupt visitors' browsers/computers
Note: most insecure WP sites are operated by insecure webdevs so add: follow webdev/admin connection home to corrupt computer and/or steal PII.

* as undocumented part of an app (or just straight malware) downloaded to a user's computer whenever the user goes online with browser open bot pretending to be that user with that browser goes to various sites, acts as typical user, either clicks specific ads and behaves on landing page as typical user or is accepted as 'seeing' CPM ads within requirements.

A bonus SM (!WP) scenario:
* target and phish employees (yes, it's no longer just email and USB sticks) for both personal and organisational access. Studies have shown a consistent 25% - 33% success rate.

[RhinoFish]

I like big bots and I cannot lie!

[tangor]

(checking logs for new rhinofishbot ...)

[iamlost]

If the horn doesn't gore you the tail slap will...

[tangor]

OUCH!