0

I requested a feature and the voting is currently in progress, which I believe has been hacked, and heavily down-voted. I believe the hacker might have taken the following steps to achieve this:

  1. Create a bot program to automatically create new email-id's. This would also include passing the OCR test by the bot program.
  2. The bot program then creates a fake account on SE with fake profile information from a names-database after linking the email-id by auto-verifying the email verification link.
  3. The bot then executes activities tailor-made to suit SE site emulating a human user, like up-voting, down-voting questions sorted by Activity, posting differently worded naive questions (mostly probably duplicates), answering a closed off-topic post with a paragraph answer obtained by first result of Google search using the question's keywords, and keep gaining reps with these activities.
  4. Once the bots have reached a reasonable threshold reps that provide them vote-casting security-rights, the hacker then issues a RPC to all the bots to down-vote the selected voting process.

Is programming such a bot possible? I think the above bot program would be an easy script for the hacker, and he might be executing all the the above steps as a pseudo-human bot because Optical Character Recognition (OCR) software is already there, along with web-simulation tools. It's just like arranging the pieces together in the script to achieve the bot-engine functionality.

What are the security checks and firewalls on SE which prevent such bots? How would you identity whether such bots are running in the system, if any? If you are assigned to specifically check for a dormant bot, which is currently in deep hyper-sleep, but which can become active later at any unpredicted time, how do you proceed?

If you believe such bot programs don't exist, what makes you think programming them is so hard? What are the programming challenges involved in designing and implementation of such bot-engine?

closed as off-topic by LvB, Rory Alsop Jun 13 '16 at 19:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

locked by Rory Alsop Jun 13 '16 at 19:01

This post has been locked while disputes about its content are being resolved. You may discuss this on meta if you have concerns.

Read more about locked posts here.

  • 11
    Sounds like a lot of work just to cast downvotes. MSO can be a vicious place. Keep in mind that downvotes on the Meta sites are also used to express disagreement. And your proposal is a radical change, those are usually unpopular there. So, I don't think there was any hacking involved; it's probably just MSO being a harsh place. – S.L. Barth Jun 13 '16 at 9:47
  • 3
    You need 125 rep to downvote. I think it's pretty much impossible to create a bot that gains that much rep. – paj28 Jun 13 '16 at 9:49
  • 2
    Not so sure. You don't gain reputation by upvoting, rather by posting Q&A that are upvoted by other users. You would need a bot that automatically creates at least 67 on-topic, acceptable questions or answers or even more proper edits, and that's not so easy AFAIK. More importantly, why? A quick look at your SO profile shows that your other Q&A are not so heavily upvoted, and there are other MSO questions with a lot of downvotes (see meta.stackoverflow.com/questions/277314/…). Also, I don't think firewalls have anything to do with bots. – A. Darwin Jun 13 '16 at 10:01
  • 2
    I think you need to apply Occam's razor on this one. – Anders Jun 13 '16 at 10:42
  • 3
    Please do not delete questions by setting their content to "Deleted" - either close them properly, or flag them for closure with a moderator. – Matthew Jun 13 '16 at 14:42
3

Theoretically it is possible, but it takes a lot of skill and effort - much more than it is worth.

The captchas are created to be hard for machines, and easy for humans. This is the perpetual arms race between spammers and webmasters. It's easier to have a human verify the captcha's for this hypothetical bot network.

Gaining rep by fake posts is difficult, but not impossible. Once a few users start noticing that your bots are creating fake posts, or once SE notices copied content, the accounts doing this will get flagged and find themselves banned. And if a pattern is noticed, SE will look deeper and find out what's going on - and take drastic measures.

It's probably easier to gain rep by suggesting edits. There is, in fact, a bot that helps editors to create better edit suggestions. Copying this bot to generate automated edits could work - mostly due to the large amount of sloppy edit reviewers.

Assuming these bots do gain enough rep to vote, they can vote for each other's content, but Stack Exchange has a lot of experience in catching voting rings.

Regarding your edit: dormant bots don't need to be discovered, they only become a problem once they become active. However, SE does automatically delete unused accounts, if certain criteria are fulfilled.

So, it's not impossible, but it's very hard to pull off. The bot maker is very likely to get caught, and get banned from SE.
Over the years, SE has also become very good at catching users who, after being banned, try to create new accounts.

  • The SE peer-review is difficult but not impossible to crack, like importing questions from other websites, using spell-checkers to avoid grammatical mistakes which also avoids being downvoted. The bots are connected with each-other and other bots upvote the downvoted bot in need. – manav m-n Jun 13 '16 at 10:23
  • @manavm-n That makes the bot network a voting ring - and SE has become very good at discovering these and destroying their accounts. – S.L. Barth Jun 13 '16 at 10:33
  • 2
    @manavm-n That information is deliberately kept from us by SE, to prevent people abusing it. What is known is that they look for suspicious patterns. – S.L. Barth Jun 13 '16 at 10:39
  • 2
    @manavmn-n If by dormant you mean a bot that has already enough rep to downvote posts in the future, the answer is: they catch the vote ring, preventing the bot from gaining enough rep and deleting accounts. As to how they do it, normal users don't know it. – A. Darwin Jun 13 '16 at 10:54
  • 2
    Manavm - no, there are various things that are not going to be shared, as SE is not going to make gaming the system easier. Suffice it to say voting rings become very obvious! – Rory Alsop Jun 13 '16 at 14:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.