Reseller

Scarcity on the Internet is the siren song of bot writers. Maybe you’ve lost an eBay bid in the last milliseconds, or missed out on a hacker con when tickets sold out in under a minute — your corporeal self has been outperformed by a bot. But maybe you didn’t know bots are on a buying frenzy in the hyped-up world of fashion. From limited-run sneakers to anything with the word Supreme printed on it, people who will not accept any substitute in wearing the rarest and most sought after are turning to resellers who use bots to snag unobtanium items and profit on the secondary market.

At DEF CON 27 [FinalPhoenix] took the stage to share her adventures in writing bots and uncovering a world that buys and sells purchasing automation, forming groups much like cryptocurrency mining pools to generate leads on when the latest fashion is about to drop. This is no small market either. If your bots are leet enough, you can make a ton of cash. Let’s take a look at what it takes to write a bot, and at the bots-for-sale economy that has grown up around these concepts.

The internet is built with bots in mind and we have Google to thank for this. Their major innovation was moving us off of a curated internet to one that is machine crawled. Everyone wants good Google juice and that means building a site that is friendly to the Google bots that crawl and index the internet. This makes automation for your own purposes quite a bit easier. Namely, the monitor-bots that are used to detect when a retailer has the latest in stock. [FinalPhoenix] demonstrated a simple script that grabs the XML site map, parsing it for newly in-stock items, flagging them when found. But here’s the killer — if your monitor bot is a good one, you can turn it into a discord channel and sell subscriptions to others playing the reseller game, to the tune of $15-30 a month per subscriber.

Example slide of code used in a web-based buy-bot

Once your bot reports stock, the race is on to buy it before anyone else can. For this, you could use the APIs of the site, but that’s time-consuming and a lot easier for retailers to detect and block bot usage. For this part of her botting tools [FinalPhoenix] likes to use web-based bots that go through a browser framework like Chromium and allow obfuscation techniques like scrolling, clicking other items, random pauses, and other simple-minded actions that make your bot appear to be only human. In the examples for this talk, the Puppeteer framework was used for this purpose. In the end, the main role of this part of the bot is to use a verified account to complete the purchase as fast as robotically possible, which is why they’re called buy-bots. Retailers do have some tricks to combat these web-based attacks like adding secret keys in the DOM that need to be sent with the next post, but these are easy to discover and incorporate into the scripts.

This raises up another interesting part of the scheme, the verified accounts. For the best chance at profit, you need multiple accounts, each used just one time to avoid your buy-bot being detected by the retailer. For this, [FinalPHoenix] turns to services that sell accounts in packages of 500-10,000 and cost around just $5-10 per batch.

But wait, here’s where it gets really wild as recursion takes hold. Yes, these buy-bots are for sale (from sites like AIO Bot and usually around $300-1500), but they’re sold in limited quantities so that it’s harder for retailers to notice and take countermeasures. Just like how the clothing was limited release and incentivized bots-wielding resellers to enter the market, there is a secondary market for the bots themselves. [FinalPhoenix] reports that reselling one of these bots can yield $1000-1500 in profit. The same principles apply, and so what we’ve ended up with is bots buying bots to buy clothes. Who knows how many levels of bot-bot transactions there are, but it certainly feels like turtles all the way down.

Bot-based high-speed trading is the real way to make major bank on the securities market. Your average hacker is shut out of that “legitimate” business, but any enterprising programmer has the option of automating whichever reseller market they find most interesting. This breaks the public trust in commerce — buying quality products from a seller connected to their production for a reasonable price. If frustrates the manufacturer, alienates the consumer, but there appears to be little in place preventing it.

[Charles Ouweland] purchased some parts off Aliexpress and noticed that the Texas Instruments logo on some of his parts wasn’t the Texas Instruments logo at all, it was just some kind of abstract shape that vaguely resembled the logo. Suspicious and a little curious, he decided to take a closer look at the MCP1702 3.3v LDO regulators he ordered as well. Testing revealed that they were counterfeits with poor performance.

Left: counterfeit part. Right: genuine Microchip MCP1702-3302

Looking at the packages, there were some superficial differences in the markings of the counterfeit MCP1702 versus genuine parts from Microchip, but nothing obviously out of place. To conclusively test the devices, [Charles] referred to Microchip’s datasheet. It stated that the dropout voltage of the part should be measured by having the regulator supply the maximum rated 250 mA in short pulses to avoid any complications from the part heating up. After setting up an appropriate test circuit with a 555 timer to generate the pulses for low duty cycle activation, [Charles] discovered that the counterfeit parts did not meet Microchip specifications. While the suspect unit did output 3.3 V, the output oscillated badly after activation and the dropout voltage was 1.2 V, considerably higher than the typical dropout voltage of 525 mV for the part, and higher even than the maximum of 725 mV. His conclusion? The parts would be usable in the right conditions, but they were clearly fakes.

The usual recourse when one has received counterfeit parts is to dump them into the parts bin (or the trash) and perhaps strive to be less unlucky in the future, but [Charles] decided to submit a refund request and to his mild surprise, Aliexpress swiftly approved a refund for the substandard parts.

While a refund is appropriate, [Charles] seems to interpret the swift refund as a sort of admission of guilt on the part of the reseller. Is getting a refund for counterfeit parts a best-case outcome, evidence of wrongdoing, or simply an indication that low value refund requests get more easily approved? You be the judge of that, but if nothing else, [Charles] reminds us that fake parts may be useful for something perhaps unexpected: a refund.