4chan hacker discusses the manipulation of the Time poll

http://musicmachinery.com/2009/04/15/inside-the-precision-hack/

by mcantelon • 17 years ago

120 29 17 years ago

noodle3• 17 years ago

i have to admit, gaming the poll is kind of silly, but this is a pretty interesting recap of the process.

ja27• 17 years ago

I'm always amazed by what lengths random people will go to hack software. Half my developers don't even understand SQL injection attacks. There's not one of them that really understands buffer overflows. So what chance do I have of getting a secure product out?

Those sorts of things really should be part of every programmer's education.

mattmcknight• 17 years ago

This seems far simpler than SQL Injection of Buffer Overlow attacks. Why doesn't Time require some kind of registration? They could use registered users as a basis for, dare I say, "Web 2.0" features.

noodle3• 17 years ago

they were in mine. in fact, had a whole class and (private, disconnected, secure) lab devoted to them. covered everything from your basics (buffer overflow, sql injection) to more interesting stuff (analyzing/creating/decompiling viruses). it was my favorite class. good times.

i was thoroughly surprised when i started working in the "real world" and no one had any clue about what i thought was basic security practices.

ryanwaggoner• 17 years ago

So...where do you work?

frisco• 17 years ago

4chan is basically the definition of silly.

mahmud• 17 years ago

4chan, overall, might be silly, but /b/ is trolling elevated to an art form. absolutely, the most depraved and nihilistic of all the internet, so much so that it becomes something beautiful. /b/ is the works of Marquis De Sade, John Waters, Roger Corman, Banksy, Cortney Love and Dead Kennedys all rolled into one. (also, throw in Kant and Hegel for good measure, because /b/ operates under its own dialectic.)

It's the low points of humanity pursued with ecclesiastical rigor. /b/ will fuck you over in every possible way, for no reason, and you will get up whipping your bloody nose knowing you have made someone else's lulz possible. And what pleasure!

joshsharp• 17 years ago

I was surprised to read how easy it was to game... at the heart of the success seems to be a real lack of quality coding on Time's behalf.

Frazzydee• 17 years ago

quite surprising, since time's poll has historically been a target of similar attacks.

extension• 17 years ago

Fair internet voting is generally an unsolvable problem, unless you have a voting list from a more reliable source and you can authenticate people on that list. Despite best practices, any high profile "best person in the world" poll has a pretty good chance of being won by moot/Lowtax/gimmick-meme-of-the-day.

colinplamondon• 17 years ago

Best answer is probably just to use Facebook Connect- they're already pouring money into CS reps whose job it is to take down fake accounts. Blocks out people who aren't on Facebook, but it's a simple solution to something that can otherwise be a huge timesink.

coopr• 17 years ago

Indeed Switzerland seems to seem think that fair internet voting is possible - http://www.geneve.ch/evoting/english/presentation_projet.asp and http://www.cbsnews.com/stories/2004/09/25/world/main645615.s... describe how they've experimented with it in national elections.

jacoblyles• 17 years ago

What could they have done to prevent this?

Steve0• 17 years ago

Several (flawed)things, limit voting to ip, mail confirmation, but I think a captcha would be the best trade-off between inconvenience for the user and blocking bots.

EvilTrout• 17 years ago

Choosing a new salt that isn't easily obtainable in a flash applet would certainly help :)

Mgreen• 17 years ago

Looks like they are still using the same codebase that was gamed before. http://news.ycombinator.com/item?id=27475

anticucho• 17 years ago

I really enjoyed reading this article. Zero Cool would be proud.

Confusion• 17 years ago

At the end, it appears the author doesn't really get it. He thinks there was luck involved:

Ultimately, this hack involved [..] and a little bit of luck. Someone figured out the voting URL protocol. [..] and a member discovered the ’salt’

There is no luck involved in figuring out the 'protocol' and discovering this kind of 'salt'.

dhs• 17 years ago

I believe that "luck" alludes to one of them finding out that voters using an IPv6 address wouldn't be blocked (IPv4 sites got blocked if they voted for the same candidate more often than once every 13 seconds).

entelarust• 17 years ago

At it again: Website users create internet script in attempt to reach 1,000,000 followers first http://www.bnonews.com/news/261.html

robryan• 17 years ago

they could just captcha the poll, it's not like they really need the random votes of people to lazy to fill it out in the first place.

seems like ip authentication is useless now because of the amount of proxies avaliable to people.

neilo• 17 years ago

Time used GET to execute the vote script? Initially someone could have set an IMG SRC to the desired URL, right? That's just nuts, you wouldn't even have to click a link at that point

4chan hacker discusses the manipulation of the Time poll

Related Stories