4 ms·

Reddit hacking for votes and profit

50 points by fseek 16y ago

wardrox 16y ago
As a Reddit Mod, this doesn't seem to counter one of the best defences against people spamming their own content: training the spam filter to hate a specific URL. This system would only seem to work if the URL got through the spam filter, so isn't much use to the kind of voting rings you tend to find already operating on Reddit. Though it's still a very valuable proof of concept.
- keefe 16y ago
  the URL being linked need not necessarily go directly to the target site. also I cringe at the fact that this is called a "hack".
  - fungi 16y ago
    hack a day was bleeding cash so owner made it more mainstream
StavrosK 16y ago
This is odd, considering how reddit bans the submission as soon as two accounts vote on it from the same IP. EDIT: Hmm, the page in the video says "unique IPs", so it looks like they are used remotely. Odd.
- terra_t 16y ago
  I knew this purple-haired superheroine who did this to a certain "Zone" which is famous for vapid and incoherent blog postings written in broken English. She made about 1000 fake accounts and used Tor to make them appear to come from multiple IP addresses. The fake accounts were made with a statistical model that generated plausible usernames, real names, profile pictures and everything -- it could even pair up the gender of the first name and of the picture... most of the time. Once she wrote a blog post she'd just set the sequencer and her posting would hit the front page in about two hours. She found it was a very consistent way to get 5k page views, sometimes better if the blog posting was good and it got picked up on other social media sites like proggit. She'd gotten a few of her blog posts to be "all time favorites" on this site, but then another project eclipsed her blogging and she lost the credentials for the fake accounts in a hard drive crash. Today, this "Zone" is dominated by other people doing the same thing. If you know what to look for, there's a quite unmistakable signature. She thought about doing the same for reddit, but it was clear at the start that reddit had much better defenses -- it would have been a bigger project, and she probably would have burned some of her proxies before getting it right. Note that you can get around the IP address problem in several ways. One of them is that you can rent SOCKS5 proxies for $3/month/IP address. Supervillians use bot nets.
  - barrkel 16y ago
    I believe those cheap SOCKS5 proxies are often actually implemented over bot nets.
    - terra_t 16y ago
      You can definitely buy them from people who host their own machines in data centers.
      - barrkel 16y ago
        I don't doubt that; but one should be suspicious of bulk proxy server lists sold for very low rates.
  - jacquesm 16y ago
    For every good thing that you could create on the internet there are going to be people hell bent on screwing it up. Your 'friend' and her copycats think they are somehow entitled to that traffic, which in the long run is responsible for the famous eternal September feeling that many websites have. Gaming the system is like the internet equivalent of slash-and-burn agriculture. I don't care whether it works or not, or whether you consider it justified because her content was good I think it sucks. If you want to have that traffic start your own social site, promote that and make it work, then feel what it is like to have people come out to game the system and use your knowledge of how such systems can be gamed to put a stop to it.
    - terra_t 16y ago
      It's hard to say. The toughest problem people have starting community sites is getting the community. Dealing with problem behaviors is something you worry about after you've got the community. Just as casinos hire shills, many community site operators use Mechanical Turk or statistical models to get the ball rolling... Who knows, we might soon have replicants that are more satisfying to interact with than ordinary humans.
    - keefe 16y ago
- Udo 16y ago
  This is odd, considering how reddit bans the submission as soon as two accounts vote on it from the same IP. So whenever two people post/vote from the same corporate network, they are completely screwed? At the same time, this "restriction" is almost meaningless to a real fraudster. Awesome.
kylec 16y ago
...as long as the article is interesting, this can be quite successful. If the article's interesting you don't need to game the system - people will vote on it naturally.
- terra_t 16y ago
  Not necessarily. Most people find success on social media sites is capricious; not a lot of people read the "new" queue, so your first few organic votes are a matter of luck. Downvotes on reddit make this go double. Even great content can get buried if it doesn't get noticed. For instance, there's a certain blog on a three letter domain name for which I'll sometimes see two or three posting on the front page at HN. That guy's got a voting ring. You might call it something else, like "I have a twitter account with a lot of followers who use HN", but that's what it is. This sort of practice takes some of the chance and variation out. An advanced method is to recognize the role of "social proof" in social media. My informant has collected behavioral data sets from certain social media sites and discovered that the C.T.R. on articles increases as the number to the left increases: even if the headline is uninteresting, the high number makes people think that it "has to be good;" in experiments where the number of "ringer" votes was varied, she discovered that the ratio of "organic" to "ringer" votes got better the more "ringers" there were.
  - katovatzschyn 16y ago
    the high number makes people think that it "has to be good;" I will claim guilty to this. Whenever a thing is esteemed by many, especially people respected, I will always contemplate its worth far longer than if I passed by something unannounced and unawares. "If an intelligent man delights so in this, why don't I?" ... and the pause is probably enough.
  - barrkel 16y ago
    It's rather ironic too, as jgc has a background in anti-spam. That's not to say his content is spam; but it is usually merely good.
  - stcredzero 16y ago
adn37 16y ago
More info on the technical side would have been far more interesting, ihmo. command control system implementation, software stack, coupling the capta with a captcha filling service... (I do not support this kind of scheme)
Stevenup7002 16y ago
I really don't see the point any more, almost everyone who uses these sites can pretty much automatically tune themselves out from spam now. Give up.
- terra_t 16y ago
  The people who do things like this, those who do any social media operations (SMO), are smart enough to use it to promote 'acceptable' content that won't be flagged as spam. If it comes down to a war with the operators of the site, you will lose. If it gets personal, they'll burn you. Successful SMO promotes content which, plausibly, you'd imagine succeeded organically. Sometimes the content is excellent and sometimes it's a little substandard, but it doesn't stick out as spam. It decorates itself in a pretty cloak to look legitimate. Unethical tactics in SMO are like steroid use in sports: Steroid users aren't lazy people taking a shortcut, they're people who train hard, can play a good game honestly, but are looking for an edge that will keep them in the market. It's a tough business because social traffic isn't good traffic for people who play the numbers game. You've got to relentlessly produce fresh content and relentlessly promote it. If you stop, you could be left with little permanent traffic. You'll get hooked on social traffic, however, by the ego rush you get the first time you get a burst of it and it crashes your server.
  - stcredzero 16y ago
    If you replace SMO with propaganda, your comment makes an even more thought provoking read.
    - terra_t 16y ago
      Good insight. My thinking today has moved beyond SMO more in the directions of public relations.
  - Stevenup7002 16y ago
    Good point, I stand corrected.
SkyMarshal 16y ago
Link to the actual article: http://www.esrun.co.uk/blog/cheating-reddit-auto-votes/ http://www.esrun.co.uk/blog/cheating-reddit-auto-votes/

50 points by fseek 16y ago

As a Reddit Mod, this doesn't seem to counter one of the best defences against people spamming their own content: training the spam filter to hate a specific URL. This system would only seem to work if the URL got through the spam filter, so isn't much use to the kind of voting rings you tend to find already operating on Reddit. Though it's still a very valuable proof of concept.

keefe 16y ago
the URL being linked need not necessarily go directly to the target site. also I cringe at the fact that this is called a "hack".
- fungi 16y ago
  hack a day was bleeding cash so owner made it more mainstream

StavrosK 16y ago

This is odd, considering how reddit bans the submission as soon as two accounts vote on it from the same IP. EDIT: Hmm, the page in the video says "unique IPs", so it looks like they are used remotely. Odd.

terra_t 16y ago
I knew this purple-haired superheroine who did this to a certain "Zone" which is famous for vapid and incoherent blog postings written in broken English. She made about 1000 fake accounts and used Tor to make them appear to come from multiple IP addresses. The fake accounts were made with a statistical model that generated plausible usernames, real names, profile pictures and everything -- it could even pair up the gender of the first name and of the picture... most of the time. Once she wrote a blog post she'd just set the sequencer and her posting would hit the front page in about two hours. She found it was a very consistent way to get 5k page views, sometimes better if the blog posting was good and it got picked up on other social media sites like proggit. She'd gotten a few of her blog posts to be "all time favorites" on this site, but then another project eclipsed her blogging and she lost the credentials for the fake accounts in a hard drive crash. Today, this "Zone" is dominated by other people doing the same thing. If you know what to look for, there's a quite unmistakable signature. She thought about doing the same for reddit, but it was clear at the start that reddit had much better defenses -- it would have been a bigger project, and she probably would have burned some of her proxies before getting it right. Note that you can get around the IP address problem in several ways. One of them is that you can rent SOCKS5 proxies for $3/month/IP address. Supervillians use bot nets.
- barrkel 16y ago
  I believe those cheap SOCKS5 proxies are often actually implemented over bot nets.
  - terra_t 16y ago
    You can definitely buy them from people who host their own machines in data centers.
    - barrkel 16y ago
      I don't doubt that; but one should be suspicious of bulk proxy server lists sold for very low rates.
- jacquesm 16y ago
  For every good thing that you could create on the internet there are going to be people hell bent on screwing it up. Your 'friend' and her copycats think they are somehow entitled to that traffic, which in the long run is responsible for the famous eternal September feeling that many websites have. Gaming the system is like the internet equivalent of slash-and-burn agriculture. I don't care whether it works or not, or whether you consider it justified because her content was good I think it sucks. If you want to have that traffic start your own social site, promote that and make it work, then feel what it is like to have people come out to game the system and use your knowledge of how such systems can be gamed to put a stop to it.
  - terra_t 16y ago
    It's hard to say. The toughest problem people have starting community sites is getting the community. Dealing with problem behaviors is something you worry about after you've got the community. Just as casinos hire shills, many community site operators use Mechanical Turk or statistical models to get the ball rolling... Who knows, we might soon have replicants that are more satisfying to interact with than ordinary humans.
  - keefe 16y ago
Udo 16y ago
This is odd, considering how reddit bans the submission as soon as two accounts vote on it from the same IP. So whenever two people post/vote from the same corporate network, they are completely screwed? At the same time, this "restriction" is almost meaningless to a real fraudster. Awesome.

kylec 16y ago

...as long as the article is interesting, this can be quite successful. If the article's interesting you don't need to game the system - people will vote on it naturally.

terra_t 16y ago
Not necessarily. Most people find success on social media sites is capricious; not a lot of people read the "new" queue, so your first few organic votes are a matter of luck. Downvotes on reddit make this go double. Even great content can get buried if it doesn't get noticed. For instance, there's a certain blog on a three letter domain name for which I'll sometimes see two or three posting on the front page at HN. That guy's got a voting ring. You might call it something else, like "I have a twitter account with a lot of followers who use HN", but that's what it is. This sort of practice takes some of the chance and variation out. An advanced method is to recognize the role of "social proof" in social media. My informant has collected behavioral data sets from certain social media sites and discovered that the C.T.R. on articles increases as the number to the left increases: even if the headline is uninteresting, the high number makes people think that it "has to be good;" in experiments where the number of "ringer" votes was varied, she discovered that the ratio of "organic" to "ringer" votes got better the more "ringers" there were.
- katovatzschyn 16y ago
  the high number makes people think that it "has to be good;" I will claim guilty to this. Whenever a thing is esteemed by many, especially people respected, I will always contemplate its worth far longer than if I passed by something unannounced and unawares. "If an intelligent man delights so in this, why don't I?" ... and the pause is probably enough.
- barrkel 16y ago
  It's rather ironic too, as jgc has a background in anti-spam. That's not to say his content is spam; but it is usually merely good.
- stcredzero 16y ago

adn37 16y ago

More info on the technical side would have been far more interesting, ihmo. command control system implementation, software stack, coupling the capta with a captcha filling service... (I do not support this kind of scheme)

Stevenup7002 16y ago

I really don't see the point any more, almost everyone who uses these sites can pretty much automatically tune themselves out from spam now. Give up.

terra_t 16y ago
The people who do things like this, those who do any social media operations (SMO), are smart enough to use it to promote 'acceptable' content that won't be flagged as spam. If it comes down to a war with the operators of the site, you will lose. If it gets personal, they'll burn you. Successful SMO promotes content which, plausibly, you'd imagine succeeded organically. Sometimes the content is excellent and sometimes it's a little substandard, but it doesn't stick out as spam. It decorates itself in a pretty cloak to look legitimate. Unethical tactics in SMO are like steroid use in sports: Steroid users aren't lazy people taking a shortcut, they're people who train hard, can play a good game honestly, but are looking for an edge that will keep them in the market. It's a tough business because social traffic isn't good traffic for people who play the numbers game. You've got to relentlessly produce fresh content and relentlessly promote it. If you stop, you could be left with little permanent traffic. You'll get hooked on social traffic, however, by the ego rush you get the first time you get a burst of it and it crashes your server.
- stcredzero 16y ago
  If you replace SMO with propaganda, your comment makes an even more thought provoking read.
  - terra_t 16y ago
    Good insight. My thinking today has moved beyond SMO more in the directions of public relations.
- Stevenup7002 16y ago
  Good point, I stand corrected.

SkyMarshal 16y ago

Link to the actual article: http://www.esrun.co.uk/blog/cheating-reddit-auto-votes/ http://www.esrun.co.uk/blog/cheating-reddit-auto-votes/