The Lab Bunny Experiment

She smiled sadly. "Don't worry. We can do it. I've been thinking about this for almost a year and I know how it can be done. I just need someone who can program the emails. I'm sure that you can do that."

"How?" Marco's voice dripped with disbelief.

"You spam them just like they spam us. If they can spam us, then we can spam them back the same way. Think about what they do. I mean day-to-day. They send an email to a million people--"

"A hundred million people," Marco said.

"Okay. Even better. A hundred million people, and then they wait for a few of them to reply so that they can follow up. Not many people take the bait. Maybe what? Maybe a dozen people reply to each email. Then the scammers start working on the nibbles, looking for one that they can hook and start robbing big time. But what happens if each email that they send out gets a million replies? What happens if almost all of those replies are bogus? What happens if the few real leads that they get are lost in a sea of false emails? Their scam will fail because they can't answer a million emails every day to try to find out which one came from a live sucker. All we have to do is make a program that answers every scam email with a flood of real-sounding replies and they'll never be able to cope."

We looked at her in amazement as her scheme began to penetrate our brains.

"It's a denial of service attack," Will Lee said.

"A denial of scam attack, you mean," Ahmed said.

"I could write a reply bot in a couple of days," Yit'gien said.

"It should be distributed," Ernesto said. "We don't want the scammers to be able to filter out the false emails by IP address."

"We can spoof sender addresses pretty easily," Ahmed said. "You should look at SMTP some time. It's a brain-dead protocol. Spoofing it is kiddie stuff. You can do it with a Linux script."

"What about the replies?" I said. "They have to be believable. That means some variation. If they're all identical, then they can be filtered automatically."

"No problem," Marco said. "I can write a grammar that'll generate replies. It'll used different words and write sentences in different orders. It'll make different length replies. They won't filter those out with any kind of regular expression."

"Are we going to get arrested?" Will Lee asked.

"No. We aren't going to do anything illegal. There's no law against replying to a Nigerian money scam email. We're not hacking into their computers."

"We'll be hacking into other people's computers if we have to set up a zombie network to stage the distributed attack," Ernesto said.

"We don't have to break into anybody's computer," I replied. "I can get some of my friends to volunteer their computers during their down times. I'm sure that you can, too. Everybody hates spam. We can probably get access to a hundred computers in a couple of days just by asking. Hell, if we ask our friends to ask their friends, we can probably get ten thousand computers before we know it. We'll have our own cloud. If each computer sends only a hundred emails, that's a million emails every day."

"It'll have to be coordinated," Will Lee said. "We have to make sure that only one scam is targeted at a time to make sure that it gets totally overwhelmed." He started drawing a diagram on the lab whiteboard.

"I'll see you on Monday," Bunny said as she let herself out.

Nobody heard her leave. We were too busy planning our distributed-denial-of-scam attack.

This was a lot more fun than research.

But it was research. The best kind: publishable research. I could already imagine the paper that I was going to write for next year's Black Hat Conference. Paper? No. I was going to organize a full session. We'd all be giving papers on our DDSA.

This was going to be great.

* * *

I was receiving my first blowjob ever when there was a sharp rap on the door.

Bunny paused just long enough to say, "Ignore it. They'll go away."

The feeling of her velvet tongue swirling around the head of my cock was again driving me deep into a delirious well of ecstasy when Professor Gomplik's voice yelled, "What's going on in there?"

"Fuck him," I whispered to Bunny. "He'll go away."

He didn't go away, but Bunny didn't stop, either.

A few minutes later, his yells of annoyance were drowning out my howls of joy. Which was okay by me.

When I opened the door, I was still flushed with pleasure. He was flushed with anger.

"What are you doing in there?" he yelled.

"Getting a blowjob," Bunny replied from behind me.

"What?"

"I just gave Stan his first blowjob. It went very well." I could hear her smacking her lips.

She had no shame. I loved her all the more for that.

Gomplik fell silent. It was the first time I had ever seen him at a loss for words. It might well have been the first time in his life that it had ever happened.

"If you'll excuse me, my work is done for the day." She pushed Gomplik aside and left the room.

Gomplik turned and yelled at her back, "You whore!" Not exactly a brilliant remark but at least he had found a word.

The wrong word.

Bunny stopped, turned, and said, "Oh, no. Whore's get paid for sex. I don't get paid. I do it because I like it. I'm no whore. I'm a slut. There's a big difference."

She did not slam the door but the thump echoed in the silent room.

Somewhere across the hall, a robot motor was whining.

Gomplik stuck his head through the back door and looked at the mattress with the rumpled sheet. "That woman is not to come back here."

"Actually," I said, "she's collaborating with us on a research project. She's become an invaluable resource."

"What kind of research?" Gomplik asked. "This isn't a biology lab. We don't experiment on human sexuality here."

"Research on denial of service attacks," I said. "It's a personal interest of hers. We're almost ready to begin the empirical phase."

"I haven't heard anything about this."

"She just proposed it to us last week. She had a brilliant idea for a new application. We're all really excited about it."

"What about your thesis? Chapter Two is overdue."

"Two and three are finished," I said. "I'll email them to you this afternoon. I was inspired to work on it last week. She helped with that, too." She did. I was spending all my time in lab waiting to catch any glimpse of her and I had been immersing myself in my work to take my mind off thinking about what she was doing with the other guys in the back room. I'd never had such a productive week.

"Hmmph," Gomplik snorted. "We'll see how inspired you were. Send me what you have."

"Right away."

"What about you?" he asked Will Lee. "Any progress yet?"

"Yes, sir," Will replied. "I was inspired by our new colleague, too. I've almost finished the network management engine that you suggested. I did a lot of coding last week."

Apparently, Will Lee was inspired by Bunny the same way as I was.

"I'll believe that when I see it," Gomplik replied.

"I can show it to you on Monday if you like," Will said. "I've got a couple of bugs left that I'll kill over the weekend."

"What about you?" he said to Ernesto. "You ready for your next comprehensive exam yet?"

"I sent a request to my committee chair last Friday asking for it to be scheduled before the end of the month."

"And you?" He looked at Yit'gien.

"I gave a draft of my thesis proposal to Professor Mbali yesterday. I wanted her comments on the feasibility of my statistical methodology before I gave it to you. She promised to get it back to me within a week."

It sounded like everyone had been as inspired by Bunny as I had.

"I don't want to see that woman around here again," Gomplik said to no one in particular as he stormed out of the lab.

We looked at each other. He wouldn't see her around again if he never came back to the lab. Otherwise it was inevitable that he'd run into her again because we weren't going to send her away.

"We could schedule meetings with him in his office whenever Bunny's in the lab," Will Lee suggested.

"Fuck him," Ernesto replied. "If he wants to hang around the lab, then he's going to have to get used to Bunny being here. He can just man up and suck it up because I'm letting her in any time she knocks on the door."

"Right on," Marco said.

And that was that. Bunny was more important to us than our supervisor. That was a simple fact.

"I guess asking Gomplik to authorize a badge for her is out of the question now," I said.

The other guys laughed.

I wasn't joking. I was beginning to develop a Pavlovian response to the damned lab doorbell. Every time I heard it ring, I began drooling testosterone.

"Now, let's get this grammar working so that we can start generating email," Marco said. The grammar was the most sophisticated part of the project and he had it almost working. It was going to be a gem. Marco was a genius at designing formal grammars. His first test replies read just like they were written by real people, apart from a few glaring glitches like phrases repeated too often. Most important, the replies were so different, one from another, that I couldn't tell that they'd all been generated by the same program.

I think that he had developed some new innovations in grammar design that would be worth a publishable paper in a decent journal.

Our lab bunny was more important to us than our supervisor because she was doing more to inspire us than he ever had.

It was such a joy to work with her.

* * *

"Do you want to do the honors?" I asked.

"I'd love to," Bunny answered. "What do I have to do?"

"You pick out an email and then fill out the form." For our first iteration, I had cobbled together a manual interface. Bunny would have to type in the address for the replies, fill in a couple of other details, and then press the button labeled Send a Flood.

"That was easy," said after she pressed the button.

"Watch," I said, pointing to the monitor screen.

For our first test, we had over a dozen volunteer computers sending out emails for us. The reply bot programs would report back as they worked. We watched as reports scrolled up the screen. On one side, a counter displayed accumulated responses. A dozen...two dozen...a hundred...a thousand. Within a few minutes, several thousand emails had been sent to the reply address, every one of them looking like a real person asking about how to get the money from a bank in Buriko Fasco, as promised in the email that he had received.

For amusement, Bunny watched as I clicked on a button to pause the scrolling and then clicked on one of the message summary reports. It expanded to show the entire message that had been sent -- a sincere sounding expression of hope and interest followed by a request for more specific information about something in the original email: a telephone number, a name, or some other trivial fact. The purpose of this was to force the scammer to reply with specific information rather than simply sending a general reply.

A second counter appeared below the first and began to register secondary hits. The bots were programmed to look at return emails from the scammer's address and send a second email asking for more clarification. This counter was giving us the most important information on the screen. If it counted up quickly, then we would know that we were hitting an automatic reply program and had not yet engaged a human being. If it counted slowly, then that meant that a human at the other end was trying to reply manually. When it stopped registering hits at all, then the spammer had given up trying to reply to the flood.

Every time the spammer answered the bot's query, it would send yet another email asking for more clarification. It would do that forever, no matter what the spammer wrote. If that happened, the monitor would start displaying third, fourth, and fifth counters as necessary. We thought that unlikely, though. The bot's second and third queries were not as convincing as its first and the spammer would realize that he was caught in a loop almost right away. It didn't matter, though. There were millions more first queries waiting to consume the spammer's time.

"Look at that," I said. "The secondary counter only recorded eight replies in three minutes. Some stupid spammer was trying to answer our flood manually, probably by sending out pre-written emails, one at a time. There haven't been any more responses in the last two minutes. I bet he's given up already."

The guys clustered around the terminal cheered.

"Score one for the good guys," Ernesto said and pumped his fist in the air.

"If you've saved even one grandmother from financial ruin, then this is all worth it," Bunny said.

"We've done a lot more than that," Will Lee said. "We've declared war on a whole gang of thieves and liars."

"And we're already winning," Ahmed said, pointing at the monitor. The primary counter was up to five digits. The secondary counter was stalled at eight. No third counter had appeared. The spammer hadn't even tried to follow up on any second reply.

"This is making me horny," Bunny said, grabbing my hand. "Do you want to take me to the back room?"

I did.

"How do you want me?" she asked as soon as she locked the door.

"Lady's choice," I said.

"I'd like some regular, old-fashioned lovin'," she said, unbuttoning her blouse.

That's exactly what I gave her.

It was simple, intimate, and wonderful.

* * *

We began targeting a different scam letter every day and got the same results every time.

Word of our success spread. Complete strangers began asking us if they could install our bot on their computers to help in the fight. A lot of people really hated the spammers.

Within weeks, we had more than ten thousand computers running the bots and were targeting a dozen scam emails every day.

Bunny continued to stop by twice a day, now always wanting to look at the monitors for a few minutes before taking us to the back room and making us the happiest geeks on earth.

The spammers tried fighting back. We could see when they installed a counter-bot that automatically answered every email that we sent to them because the secondary and tertiary counters began rolling into high numbers fast. But it was a stupid and useless strategy for the spammers. Our bot just kept flooding their counter-bot with more emails. No matter what they did with their bots, they had to answer emails by hand at some point to hook a sucker. No bot could do that for them. And they could never keep up with us. Any real suckers were hidden by a million fake emails.

Then a miracle. The number of Nigerian money scam letters that we were receiving began to drop in frequency. A month after we began, we were having a problem finding any scam emails to target. In the first week of the second month, we couldn't find a single person who had received any variation of the Nigerian money scam. Not a fake lottery win nor a single claim that the IRS had a refund for someone. We had killed the entire Nigerian money scam industry in four weeks.

Originally, we had intended to make a bot that could read the emails so that we wouldn't need a human to fill out a form to start the process. That proved unnecessary. Spam was disappearing so fast than manually filling out the form only took a few minutes a day.

We got bored so we began branching out.

It took us two days to modify our bot so that it would target Viagra spam as well as the original Nigerian Money scams.

Bunny not only approved of our expanded scope but she became creative in expressing her gratitude in the back room. Our fantasies were fulfilled in ways that we had never though possible.

I learned about the pros and cons of woman-on-top, doggie style, and a few other positions that must have been taken directly from the Kama Sutra. I liked the missionary position best and I think she did, too.

More important, she taught me how to go down on her. A woman's parts are a lot more complicated than you'd expect from just looking at them.

We got creative in our research, too. We targeted other sales spams, gambling spams, whatever. We wanted to see if we could make our mailboxes completely spam free by putting one spammer after another out of business.

A lot of the commercial spam didn't ask for a direct reply but sent the sucker to a web site to fill out a form. It was surprisingly easy to modify our bot so that it would send fake form data to a URL.

I'm not sure that it was entirely legal to do that, but nobody hassled us. I don't think that the authorities liked spam filling their mailboxes any more than anyone else.

One day, Bunny had been reading something on the web and asked us what phishing attacks were. A light went on. We wouldn't have to change our bot at all to direct it to overload phishing attack sites with false information. It probably wouldn't do a whole lot of good because those sites could implement automatic sanity checkers to filter us out, but it made us feel better to try and hassle them. They deserved at least that much.

We debated at length about borderline cases. If we'd gone to a conference once, were the conference organizers entitled to spam us for the rest of our lives about special journal articles that were related to the conference theme?

Bunny voted to leave them alone and restrict our war to unsolicited emails that were targeting everyone indiscriminately.

We considered the lab a democracy but we all knew that Bunny's vote constituted an automatic majority.

Unless you like celibacy, voting against the woman who's sleeping with you is an exceptionally bad idea. None of us wanted to go back to that monkish lifestyle.

She was probably right about only targeting clearly unsolicited spam. The spammers never tried to take us to court but I expect that a business that thought that it had a legitimate excuse to send us advertising would have taken legal action against us.

I sent proposals for paper sessions to the three most prestigious security conferences that I could find. All three were accepted. Gomplik had no choice but to approve our travel. We were making his lab famous.

I received an email from a government lab that tracked Internet traffic. The total amount of Internet traffic had begun dropping the week after we began spamming the spammers and had continued to drop as we expanded our scope. Our emails, though they numbered in the millions, were a small proportion of the Internet traffic when compared to the spammers' emails that numbered in the hundreds of millions. Sending a million emails to put one spammer out of business freed up a lot of Internet bandwidth.

The seven of us had reduced the amount of email on the Internet by more than sixty percent.

The lab proposed that we write a joint paper with them.

I'd been insisting that our lab bunny be included as an author on every paper we wrote. Attacking the spammers was her original idea, after all. She told us not to be silly, but we were determined to include her anyway. She still refused to tell us her real name so "L. Bunny" soon had a damned impressive curriculum vitae.

I was in the lab all the time and, when I wasn't working on the bot, I was working on my thesis. I finished six months ahead of my most optimistic projection.

One afternoon in June, lying in Bunny's arms in post-coital bliss, I said, "I'm going to defend my thesis in six weeks. I've been offered a tenure-track position at San Diego State University in September so I'll be moving to California right after my defense."

It took her a minute before she said, "I'm going to miss you. A lot."

"Me, too."

"I'm not going to be the lab bunny much longer. I was going to tell the guys a while back, but I've been putting it off. I..." She paused and turned to give me a peculiar smile. "You might find this odd, but I actually like being your lab bunny. It's not just the sex. I like you guys. I've never met such appreciative men."