DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So,...

39
RT2WIN! How 50 lines of Python made me the luckiest guy on Twitter

Transcript of DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So,...

Page 1: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

RT2WIN!How 50 lines of Python made me the luckiest guy on Twitter

Page 2: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

“No purchase necessary, enter as often as you want. So I am.”

Page 3: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Introduction• I’m Hunter• Electrical & Computer Engineer• Working in Silicon Valley• Currently disrupting social local mobile big data analytics with

cloud based MapReduce deployments on Docker with Rust

Page 4: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Origin• “Hey, there’s a ton of contests on Twitter. All you have to do to

enter them is retweet them…”

Page 5: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

xkcd.com

Page 6: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 7: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

“How hard could it possibly be?”

• Step 1: Look for contests, retweet them• Step 2: Profit• Started with simple search terms at first

• “rt2win”, rt to win”, “rt 2 win”, “retweet to win”, etc• Used the Twitter API• Rate limit = /• So, retweet slower, add random delays

Page 8: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

+Beautiful Soup

Page 9: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 10: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 11: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 12: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Better solution• Turn the follow queue into a FIFO• Unfollow the 1st account when I follow the 2000th account• The amount of time it takes to enter 2000 contests that require

following is enough that the 1st contest is almost certainly over by then

• Side effect: I get more real followers because people follow back as a courtesy.

• My bot actually looks more legit now

Page 13: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 14: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Interesting interactions

Page 15: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Forgot to change my name on one of my accounts that won the same contest as another one…

Page 16: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Yes, I won this.

Page 17: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Bots vs Bots

Page 18: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 19: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Someone offering a postcard signed by ME as a prize…

Page 20: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Sometimes my bot was accidentally a jerk /

Page 21: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 22: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Guess who?

Page 23: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Another false positive

Page 24: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Another false positive

Page 25: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

The Haul

Page 26: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 27: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

The full list:

hscott.net/winnings.txt

Page 28: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Doing good

Page 29: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

But even this backfired…

Page 30: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

But even this backfired…

Page 31: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

People ask you for weird stuff

Page 32: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow
Page 33: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Stats• 165,000 contests entered• On average, 4 wins per day, every day

Page 34: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Stats• 165,000 contests entered• On average, 4 wins per day, every day, for 9 months straight

Page 35: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Stats• 165,000 contests entered• On average, 4 wins per day, every day, for 9 months straight• Most valuable prize: $4000 trip to Fashion Week in NYC

Page 36: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Yes, I paid the taxes.

Page 37: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Other attempts• Before I did this, there were at most a few people auto-entering

twitter contests• Couldn’t find any obvious examples • Did see some manual examples• Now a lot of people do it

• Or at least, they try

Page 38: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

Often imitated, never duplicated

Page 39: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow

How to keep me from winning• Take two seconds and read the feed of the winner

• It will usually be pretty obvious.• I made no attempt at stealth and still won. Some people do attempt

stealth and are much harder to catch• Make it hard to programmatically enter

• Add something that requires natural language processing• Consider running the contest on Facebook

• Much harder to make a fake but convincing profile• Tied to real identity

• Accept that people always try to game contests