3 ms·

It increases the costs, sure, but is the increase significant? It seems to be fairly common to write bots for various online games that only rely on video input

by valvar 5y ago

It increases the costs, sure, but is the increase significant? It seems to be fairly common to write bots for various online games that only rely on video input. The cost of development is higher, and the hardware requirements somewhat steeper, but how much more expensive is it really? I doubt it's even close to doubling the operational costs.

buro9 5y ago
Costs change the dynamic and allows it to be a more focused problem. For example spoofing as part of DDoS is now cost-prohibitive as you either cannot achieve the scale needed or you are too slow to be effective... which makes the market for booter service less viable at their low cost. For ad-click stuff it wipes out the bottom of the market and forces the fraud on higher value adverts where it is more visible. For e-commerce bots trying to buy the latest sneakers in sneaker drops this cost is irrelevant as the benefits are huge, but... with enough of the other fraud reduced companies that provide services to protect here can focus more resources here to make it harder. Similar to how the most effective spam I now see on sites I operate is actually now human generated by cheap human labour (effective meaning "gets past layers of detection that stops it early")... the spam problem for me is effectively solved as it's been reduced so much and humans are slow and inefficient.
mike_hearn 5y ago
It's a very significant increase indeed. The increase is (or was) large enough to entirely wipe out most adversaries and restructure the battlefield in ways very advantageous to those playing defense. At least, in the social web space. Video games is a different world. This stuff is something of a secret weapon to those who know about it. Because so many developers assume it can't work the companies that master it have a large competitive advantage. Source: About a decade ago I created Google's main "device detection" platform, as this article calls it (not Picasso, the thing that executes Picasso). It's actually more like an automation detection platform, as it's not a fingerprinting or device tracker, it just tries to separate human operated from automated clients. These days I'm told there's a large-ish team that maintains it full time and has ported the concepts to other platforms like Android. It started as a 20% project because at that time almost nobody at Google took the idea seriously. Fortunately, my manager was happy to support my experiments. People had the same common (but incorrect) intuition you're displaying here, that any sort of client integrity technique is so easy to work around it's hardly worth the bother. Actually even I believed this to a large extent, just less so than the others. This turned out to be wrong for some not entirely obvious reasons related to the structure of the spam industry: 1. Most spammers are either not programmers at all, or are extremely poor programmers compared to a typical tech firm employee. They can in fact be out-coded. 2. This is because spamming is usually not all that profitable, so programmers who get good can find better and steadier money in the white market. The ones who remain are typically those who live in places without any local software opportunities (e.g. developing countries). 3. Because of this mounting even a not very strong defense is sufficient to corral your adversaries into a shallow economic pyramid, in which a small number of "skilled" people produce tools and services they sell the others, who then run the individual campaigns. This means you are probably not fighting as many people as you think you are. Screwing with the supply chain is an excellent way to wreak havoc on spammers. When we first deployed the system we spent several months tuning it in what was effectively a running battle with the major Google account sellers. We discovered that the sellers were in turn buying their account creation bots from other people, and some sellers were actually re-sellers. One of the sellers had been using a "raw" bot that didn't embed a browser engine, and thus was knocked out of the market for months as they waited for a new bot to be written from scratch. When that came online there were mistakes in its browser automation that we were able to detect. The developer of the bot couldn't de-obfuscate the JavaScript we used (too hard for them) so treated the platform as a black box, just trying random things in the hope it'd work. We could watch this evolution in real time and block new versions as they were released. After a few rounds of this the seller got sick of it and switched to a new bot supplier. This new bot also took months to complete, and when it arrived it had fixed the bug we were using to spot the first bot, but introduced new bugs the other didn't have, meaning even then it was detectable. At that point the seller gave up, as presumably paying for the development of all these bots was quite expensive relative to the margins involved. This in turn nuked all the resellers that had been relying on that guy, and blew a hole in the entire Google-oriented spam ecosystem. Spammers had to start phone verifying accounts en-masse, and for most of them it just wasn't worth it (a few switched to using stolen accounts instead of creating them). I haven't been there for years so don't know what the current state of play is, but you do still see public threads crop up from time to time where spammers say they tried to beat the system and couldn't, like this one: https://github.com/BitTheByte/YouTubeShop/issues/14 https://github.com/BitTheByte/YouTubeShop/issues/14 If you want some insights into the minds of the typical newbie spammer when faced with this system, try this search and flick through some of the results: https://www.google.com/search?q=site%3Ablackhatworld.com+botguard https://www.google.com/search?q=site%3Ablackhatworld.com+bot... NB: Sometimes people claim they've "cracked" this system but usually they mean they did a bit of reverse engineering out of curiosity. Going further and making a real spam bot that can reliably beat it is a much harder thing, especially if you want that bot to be working with HTTP directly for performance. We never saw anyone attempt to build an HTTP level bot that worked against it in the time I was there. Probably there have been some attempts in the years since.
- rdtwo 5y ago
  It makes sense that it would be super difficult to out code google. The market for these services is pretty small compared to how much google can spend to prevent and constantly combat. Also google has way better data then they attackers so they are at a significant disadvantage

by valvar 5y ago

buro9 5y ago

Costs change the dynamic and allows it to be a more focused problem. For example spoofing as part of DDoS is now cost-prohibitive as you either cannot achieve the scale needed or you are too slow to be effective... which makes the market for booter service less viable at their low cost. For ad-click stuff it wipes out the bottom of the market and forces the fraud on higher value adverts where it is more visible. For e-commerce bots trying to buy the latest sneakers in sneaker drops this cost is irrelevant as the benefits are huge, but... with enough of the other fraud reduced companies that provide services to protect here can focus more resources here to make it harder. Similar to how the most effective spam I now see on sites I operate is actually now human generated by cheap human labour (effective meaning "gets past layers of detection that stops it early")... the spam problem for me is effectively solved as it's been reduced so much and humans are slow and inefficient.

mike_hearn 5y ago

It's a very significant increase indeed. The increase is (or was) large enough to entirely wipe out most adversaries and restructure the battlefield in ways very advantageous to those playing defense. At least, in the social web space. Video games is a different world. This stuff is something of a secret weapon to those who know about it. Because so many developers assume it can't work the companies that master it have a large competitive advantage. Source: About a decade ago I created Google's main "device detection" platform, as this article calls it (not Picasso, the thing that executes Picasso). It's actually more like an automation detection platform, as it's not a fingerprinting or device tracker, it just tries to separate human operated from automated clients. These days I'm told there's a large-ish team that maintains it full time and has ported the concepts to other platforms like Android. It started as a 20% project because at that time almost nobody at Google took the idea seriously. Fortunately, my manager was happy to support my experiments. People had the same common (but incorrect) intuition you're displaying here, that any sort of client integrity technique is so easy to work around it's hardly worth the bother. Actually even I believed this to a large extent, just less so than the others. This turned out to be wrong for some not entirely obvious reasons related to the structure of the spam industry: 1. Most spammers are either not programmers at all, or are extremely poor programmers compared to a typical tech firm employee. They can in fact be out-coded. 2. This is because spamming is usually not all that profitable, so programmers who get good can find better and steadier money in the white market. The ones who remain are typically those who live in places without any local software opportunities (e.g. developing countries). 3. Because of this mounting even a not very strong defense is sufficient to corral your adversaries into a shallow economic pyramid, in which a small number of "skilled" people produce tools and services they sell the others, who then run the individual campaigns. This means you are probably not fighting as many people as you think you are. Screwing with the supply chain is an excellent way to wreak havoc on spammers. When we first deployed the system we spent several months tuning it in what was effectively a running battle with the major Google account sellers. We discovered that the sellers were in turn buying their account creation bots from other people, and some sellers were actually re-sellers. One of the sellers had been using a "raw" bot that didn't embed a browser engine, and thus was knocked out of the market for months as they waited for a new bot to be written from scratch. When that came online there were mistakes in its browser automation that we were able to detect. The developer of the bot couldn't de-obfuscate the JavaScript we used (too hard for them) so treated the platform as a black box, just trying random things in the hope it'd work. We could watch this evolution in real time and block new versions as they were released. After a few rounds of this the seller got sick of it and switched to a new bot supplier. This new bot also took months to complete, and when it arrived it had fixed the bug we were using to spot the first bot, but introduced new bugs the other didn't have, meaning even then it was detectable. At that point the seller gave up, as presumably paying for the development of all these bots was quite expensive relative to the margins involved. This in turn nuked all the resellers that had been relying on that guy, and blew a hole in the entire Google-oriented spam ecosystem. Spammers had to start phone verifying accounts en-masse, and for most of them it just wasn't worth it (a few switched to using stolen accounts instead of creating them). I haven't been there for years so don't know what the current state of play is, but you do still see public threads crop up from time to time where spammers say they tried to beat the system and couldn't, like this one: https://github.com/BitTheByte/YouTubeShop/issues/14 https://github.com/BitTheByte/YouTubeShop/issues/14 If you want some insights into the minds of the typical newbie spammer when faced with this system, try this search and flick through some of the results: https://www.google.com/search?q=site%3Ablackhatworld.com+botguard https://www.google.com/search?q=site%3Ablackhatworld.com+bot... NB: Sometimes people claim they've "cracked" this system but usually they mean they did a bit of reverse engineering out of curiosity. Going further and making a real spam bot that can reliably beat it is a much harder thing, especially if you want that bot to be working with HTTP directly for performance. We never saw anyone attempt to build an HTTP level bot that worked against it in the time I was there. Probably there have been some attempts in the years since.

rdtwo 5y ago
It makes sense that it would be super difficult to out code google. The market for these services is pretty small compared to how much google can spend to prevent and constantly combat. Also google has way better data then they attackers so they are at a significant disadvantage