Fingerprint-Based Bot Blocking & Dynamic Deception

Fingerprint-Based Bot Blocking & Dynamic Deception

Speakers: Adel Karimi, AI chatbot startup

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=G7twgn-gi9k

Overview

In this DEF CON talk, Adel Karimi introduces an innovative approach to bot detection and adversary deception through network fingerprinting and dynamic response generation. His presentation, titled "Fingerprint-Based Bot Blocking & Dynamic Deception," unveils Finch, an open-source, fingerprint-aware reverse proxy. Karimi blends his expertise in network fingerprinting, honeypots, and AI agents to address the limitations of traditional bot blocking methods, which often rely on easily faked indicators like IP addresses and user agents.

The core premise of the talk is that by analyzing deeper network metadata—specifically TLS, HTTP/1, and HTTP/2 fingerprints—defenders can gain a more reliable understanding of client identities. Finch leverages these unique identifiers to dynamically block, route, tarpit, or deceive malicious traffic, offering a sophisticated alternative to the "whack-a-mole" game of IP blocking. Karimi demonstrates how this intelligence can be amplified by integrating AI agents, which can autonomously analyze traffic patterns and update security rules in real-time, ushering in a new era of proactive and intelligent defense.

Background

▶ Watch: Introduction to fingerprint-based bot blocking tool (0:00)

The landscape of cybersecurity defense against automated threats, such as bots, crawlers, and advanced scanners, has long been plagued by the inadequacy of traditional detection mechanisms. For years, security professionals have relied on indicators like source IP addresses, user agents, and request patterns to identify and block unwanted traffic. However, as Karimi highlights, these signals are trivially spoofed or rotated by sophisticated attackers, rendering blocking efforts largely ineffective and reactive. Attackers can cycle through hundreds of IP addresses per minute or easily modify user agent strings, making it nearly impossible to distinguish between legitimate and malicious actors using surface-level data.

Karimi's journey into fingerprint-based detection began years ago with his "honey TLS" project, which leveraged Zeke (formerly Bro) to capture TLS client handshakes and other network metadata. This early work revealed that deeper packet inspection could uncover unique patterns that were invisible to conventional logging. For instance, he discovered that while 80-90% of traffic followed expected patterns (many IPs sharing a common tool's fingerprint), a small percentage of sophisticated actors exhibited highly unusual behaviors, such as a single IP address generating hundreds of distinct TLS fingerprints in rapid succession—an indicator of active evasion attempts. The challenge at that time was integrating these disparate data sources (e.g., TLS logs from Zeke and HTTP logs from Nginx honeypots) for comprehensive analysis.

Furthermore, existing Web Application Firewalls (WAFs) and cloud-based edge services (like AWS WAF or Cloudflare) often provide rudimentary bot protection, typically offering "known bad bot" checkboxes without granular control. They generally lack the capability to customize rules based on specific TLS or HTTP fingerprint values, preventing defenders from targeting tools like ZAP or Burp Suite with precision. This gap in defensive capabilities, coupled with the inherent limitations of IP and user agent-based blocking, motivated Karimi to develop Finch—a tool designed to fill this void by providing a highly customizable and intelligent reverse proxy for fingerprint-aware traffic management.

Key Findings

▶ Watch: Motivation and explanation of fingerprint-aware reverse proxy (2:00)

The talk presents several key findings and contributions that collectively advance the state of bot detection and active defense:

1. Superiority of Network Fingerprints: Karimi conclusively demonstrates that TLS, HTTP/1, and HTTP/2 fingerprints offer a significantly more robust and reliable signal for identifying client applications and malicious tools compared to easily faked IP addresses and user agents. These fingerprints, derived from the order and specific parameters within network handshakes and headers, are much harder for attackers to spoof consistently across multiple layers.
2. Uncovering Evasion Tactics: Through his earlier honey TLS project, Karimi discovered sophisticated attacker behaviors, such as a single source IP address generating hundreds of unique TLS fingerprints in sequence. This "Jaw3 rotation" pattern, where attackers systematically modify TLS parameters to evade fingerprint-based detection, paradoxically made them more identifiable when viewed through the lens of deep network analysis. This finding highlights the value of collecting and analyzing such granular data.
3. Dynamic Deception and Resource Exhaustion: Finch's capabilities to tarpit (slow down) and deceive (provide custom, dynamically generated responses) malicious clients are crucial. Karimi illustrates how these actions can waste significant attacker time and resources, turning their scanning efforts into a costly and frustrating endeavor, rather than just blocking them outright.
4. Autonomous Threat Response with AI Agents: A significant finding is the ability of AI agents to autonomously analyze complex log data, identify subtle attack patterns (like the Jaw3 rotation), and then programmatically update the rules of the Finch reverse proxy. This demonstrates a paradigm shift towards self-adapting and intelligent defensive systems that can react to emerging threats without human intervention.
5. Multi-Layered Fingerprinting for Robustness: While individual fingerprinting techniques can be evaded (e.g., using Burp Awesome TLS to fake Burp Suite's TLS fingerprint), Karimi emphasizes that combining fingerprints from multiple layers (TLS, HTTP/1, HTTP/2) creates a much higher barrier for attackers, making comprehensive evasion significantly more challenging. Attackers are likely to miss one layer, exposing their true client.

Technical Deep Dive

▶ Watch: Benefits of fingerprints for threat intelligence and analysis (4:00)

The core of Karimi's presentation revolves around Finch, an open-source, Go-based reverse proxy designed to perform intelligent traffic management based on client fingerprints. Finch acts as a middleware, sitting in front of production services to inspect incoming connections and apply rules based on various fingerprinting techniques.

Fingerprinting Mechanisms

Finch integrates several established and novel fingerprinting methods:

1. TLS Fingerprinting:

• Client Hello Analysis: The initial TLS handshake, specifically the Client Hello message, is typically unencrypted. Finch extracts critical parameters such as the TLS version, cipher suites, and extensions (including their order). These parameters are highly dependent on the underlying TLS library and operating system used by the client.
• Jaw3 and Jaw4: Finch supports industry-recognized TLS fingerprinting methods like Jaw3 and Jaw4.
• Jaw3 (developed at Salesforce) combines the version, ciphers, extensions, curves, and elliptic curve format into an MD5 hash. While effective, it can be susceptible to randomization (e.g., Google Chrome's Greece extension which randomizes extensions).
• Jaw4 is an evolution of Jaw3, designed to be more readable and resilient to randomization. It sorts certain parameters before hashing, making it more stable for clients like Google Chrome and easier for defenders to write rule-friendly signatures.

1. HTTP/1 Fingerprinting:

• For HTTP/1, Finch primarily focuses on the order of HTTP headers. Karimi notes that tools like Python requests libraries often send headers in a very predictable and consistent order, providing a strong signal for identification.
• Jaw4H: Finch also incorporates Jaw4H, the HTTP version of Jaw4, which goes beyond just header order to include other HTTP characteristics like specific cookies and referrers for more precise client identification.

1. HTTP/2 Fingerprinting:

• HTTP/2 introduces specific frames like SETTINGS, WINDOW_UPDATE, and PRIORITY. The combination and order of these frames, as observed by researchers like those at Akamai, can be highly unique to different clients and libraries, providing another robust fingerprinting vector.

1. QUIC (HTTP/3) Fingerprinting:

• Finch includes experimental support for QUIC, which implements TLS 1.3 over UDP. A key challenge with QUIC is that the TLS Client Hello is protected by encryption. However, Karimi notes that standard methods exist to recover and decode this information. Finch's support for QUIC extends Jaw3 and Jaw4 fingerprinting to this increasingly prevalent protocol, which is often overlooked by traditional network monitoring tools. A client tool is provided in the Finch repository to extract these fingerprints from QUIC traffic.

Finch Architecture and Actions

Finch is designed with simplicity and customizability in mind, using an HCL-like configuration language (similar to Terraform) for defining rules. Its core functionality revolves around collecting fingerprints and then enabling a range of actions:

• Allow: Permit traffic to pass through to the backend.
• Deny: Block the request outright.
• Route: Redirect traffic to a different backend server, such as a specific honeypot.
• Tarpit: Intentionally slow down the connection, consuming attacker resources and time. Karimi mentions slowing down an Nmap scan from 20 seconds to over 10 minutes.
• Deceive: Generate a dynamic and contextually relevant HTTP response on the fly. This leverages an LLM-based web honeypot (Karimi's previous project, Glow) to craft responses based on the incoming request, making the deception more convincing and interactive than static honeypots. Finch also supports caching these LLM-generated responses to reduce costs and latency. For even cheaper deception, it can fall back to a Markov chain-based junk response generator, as demonstrated with a leaked fake API key.

Advanced Features

• Suricata Integration: Finch can parse Suricata HTTP rules, enabling it to match incoming requests against a predefined set of threat signatures. If a request triggers a Suricata alert, this information is exposed to Finch's rule engine, allowing for fingerprint-aware actions based on Suricata messages (e.g., "if a request matches an exploit message and has this TLS fingerprint, route it to a honeypot").
• Admin API: Finch exposes an Admin API that allows for programmatic updates to its rules. This is crucial for enabling dynamic, automated responses.
• SSE Endpoint: A Server-Sent Events (SSE) endpoint streams all events and logs in real-time, providing a live feed for monitoring and integration with other systems.
• Echo Mode: Running Finch in "echo mode" (e.g., finch echo) turns it into a fingerprint collection tool. Hitting the root path displays a UI with the client's fingerprints, while /fp provides raw JSON fingerprints. This mode is invaluable for automatically generating large datasets of client fingerprints for analysis or rule creation.

Demo / Proof of Concept

▶ Watch: Why IP/User-Agent blocking is insufficient; deeper fingerprints (6:00)

Adel Karimi showcased several compelling demonstrations and proof-of-concept scenarios during his talk, illustrating Finch's capabilities:

1. Tarpitting Attackers: Karimi demonstrated how Finch can effectively tarpit known security scanners. By configuring a rule to identify the specific TLS and HTTP/1 fingerprints of tools like ZAP (OWASP ZAP) or Nmap, Finch could intentionally slow down their connections. He cited an example where an Nmap scan that would normally complete in 20 seconds was extended to over 10 minutes when subjected to Finch's tarpitting action. This highlights Finch's ability to significantly waste an attacker's time and computational resources. The talk mentions guard rails, such as limiting simultaneous connections to 16, to prevent the proxy itself from being overwhelmed.

1. Dynamic Deception with LLMs: The "deceive" action was a central demonstration. Karimi explained how Finch integrates with his previously developed LLM-based web honeypot, Glow. When a request matches a "deceive" rule (e.g., an unknown path or a request triggering a Suricata alert), Finch sends the HTTP request to Glow. The Large Language Model (LLM) then dynamically generates a plausible HTTP response, making the honeypot highly interactive and adaptive, rather than providing static, easily identifiable responses. This can trick attackers into believing they are interacting with a legitimate, complex application. To address concerns about LLM costs, Karimi mentioned caching generated responses and even demonstrated a fallback mechanism: when he leaked a fake OpenAI API key in a code snippet on Pastebin, a bot attempted to use it against his Finch proxy. Instead of incurring LLM costs, Finch responded with a Markov chain-based junk response generator, effectively deceiving the bot without spending money.

1. Autonomous Rule Updates with AI Agents: This was arguably the most forward-looking demonstration. Karimi detailed an AI agent built on top of Finch's Admin API and SSE endpoint. This agent continuously monitors Finch's logs and real-time event stream. Karimi presented a compelling example: he fed the agent 10-20 megabytes of log data, including the same logs from 7 years ago where he had accidentally discovered the "Jaw3 rotation" pattern. Using the new OpenAI GPT-5 model and explicitly enabling Python tool use (interpreter access), the AI agent autonomously analyzed the logs. Within approximately one minute, it successfully identified the subtle pattern of a single IP address systematically changing its TLS fingerprints to evade detection—a pattern Karimi himself had found accidentally after hours of manual scrolling. Based on this analysis, the agent then used another sub-agent to automatically generate and apply blocking rules via Finch's Admin API, demonstrating a closed-loop, self-adapting security system. This showcases how AI can automate threat intelligence and response, preventing scenarios like the one where an attacker exhausted his monthly LLM budget in minutes.

1. Burp Suite Fingerprinting and Evasion: Karimi demonstrated how Finch could fingerprint and block requests originating from Burp Suite's Repeater module. He then acknowledged the existence of tools like Burp Awesome TLS, a Burp Suite extension that can modify Burp's TLS fingerprints to mimic legitimate browsers. This highlighted the ongoing cat-and-mouse game and reinforced his point about the need for multi-layered fingerprinting, as attackers are less likely to fake all layers (TLS, HTTP/1, HTTP/2) simultaneously.

The demonstrations underscored Finch's practical utility in real-world scenarios, from resource exhaustion of scanners to intelligent, dynamic deception, and autonomous threat mitigation.

Defensive Implications

▶ Watch: Limitations of commercial WAFs and need for custom fingerprinting (8:00)

The insights and tools presented by Adel Karimi have profound implications for defensive security strategies, urging a shift away from easily circumvented traditional methods:

1. Elevate Fingerprinting as a Primary Detection Signal: Defenders must move beyond relying solely on IP addresses, user agents, and simple request patterns for bot detection. TLS, HTTP/1, and HTTP/2 fingerprints should be integrated as primary signals in WAFs, network monitoring tools, and custom security solutions. These deeper packet-level attributes provide a more resilient and difficult-to-spoof identity for client applications and malicious tools.

1. Implement Multi-Layered Fingerprinting: A single fingerprinting technique, while valuable, can be evaded. Defenders should strive for a multi-layered approach, collecting and correlating fingerprints from TLS handshakes (Jaw3, Jaw4), HTTP header order (Jaw4H), and HTTP/2 frames. This significantly increases the complexity and effort required for attackers to successfully mimic legitimate traffic. If an attacker manages to spoof one layer, they are likely to miss another, revealing their true nature.

1. Leverage Dynamic Deception and Tarpitting: Instead of simply blocking unwanted traffic, defenders should consider deploying dynamic deception techniques. Tarpitting can significantly increase the cost and time for attackers, potentially forcing them to abandon targets. Dynamic honeypots, especially those enhanced with LLMs, can provide rich threat intelligence by engaging with attackers, understanding their methodologies, and capturing novel attack vectors that static honeypots might miss. This shifts the defender's role from passive blocking to active resource exhaustion and intelligence gathering.

1. Integrate AI for Autonomous Threat Response: The demonstration of AI agents autonomously analyzing logs and updating Finch's rules represents a critical defensive evolution. Organizations should explore integrating AI/ML capabilities into their security operations for:

• Automated Log Analysis: AI can identify subtle, complex attack patterns (like Jaw3 rotation) across vast datasets much faster and more accurately than human analysts.
• Proactive Rule Generation: Automatically generating and deploying blocking or deception rules based on identified threats, reducing reaction time from hours or days to minutes.
• Adaptive Defense: Creating a self-improving security posture that learns from observed attacks and adapts its defenses without constant manual intervention. However, it's crucial to implement tool use (e.g., Python interpreters) for LLMs to ensure accurate and verifiable analysis rather than fabricated summaries.

1. Utilize Fingerprint Data for Threat Intelligence: The rich metadata collected through fingerprinting is invaluable for threat intelligence. By analyzing unique fingerprint patterns, defenders can:

• Attribute Attacks: Link seemingly disparate attacks from different IPs or geographies to a single actor or tool.
• Track Tool Evolution: Monitor how specific attack tools or C2 agents evolve their network behaviors.
• Proactive Blocking: Preemptively block or monitor traffic from known malicious tool fingerprints, even before specific attack campaigns are launched.

1. Adopt Customizable Edge Security: Organizations should seek or develop edge security solutions that offer fine-grained control over traffic management based on custom fingerprint rules, rather than relying solely on generic "bad bot" checkboxes. Finch provides an open-source blueprint for such a customizable system.

By embracing these defensive implications, organizations can build more robust, intelligent, and proactive security postures capable of effectively combating the evolving landscape of automated threats.

Key Takeaways

• Network fingerprints (TLS, HTTP/1, HTTP/2) provide a superior and more reliable signal for identifying bots and malicious tools than easily faked IP addresses and user agents.
• Finch is an open-source, fingerprint-aware reverse proxy that enables dynamic actions like blocking, routing, tarpitting, and deception based on client fingerprints and Suricata alerts.
• Dynamic deception, particularly with LLM-powered honeypots, can intelligently engage attackers, waste their resources, and provide valuable threat intelligence.
• AI agents, when empowered with "tool use" capabilities (like Python interpreters), can autonomously analyze vast security logs, identify complex attack patterns, and automatically update defensive rules in real-time.
• Multi-layered fingerprinting (combining TLS, HTTP/1, and HTTP/2 analysis) significantly increases the difficulty for attackers to evade detection by mimicking legitimate clients.
• Sophisticated attackers attempting to randomize their fingerprints (e.g., Jaw3 rotation) can paradoxically become more identifiable through detailed network fingerprint analysis.

About the Speaker(s)

Adel Karimi is a seasoned security professional with over a decade of experience in security detection and response. His career includes a tenure at Google and his current role at an AI chatbot startup, where he applies his expertise to cutting-edge challenges. Outside of his professional endeavors, Adel is an active contributor to the open-source community, particularly focusing on honeypot projects and network fingerprinting tools that he can freely release. His GitHub repository, 0x4D31, hosts a collection of his open-source work, reflecting his passion for practical security innovation. He is also active on Twitter under the handle @0x4D31. This marks his second appearance on the DEF CON creator stage, highlighting his continuous contributions to the security research community.