I requested a feature and the voting is currently in progress, which I believe has been hacked, and heavily down-voted. I believe the hacker might have taken the following steps to achieve this:
- Create a bot program to automatically create new email-id's. This would also include passing the OCR test by the bot program.
- The bot program then creates a fake account on SE with fake profile information from a names-database after linking the email-id by auto-verifying the email verification link.
- The bot then executes activities tailor-made to suit SE site emulating a human user, like up-voting, down-voting questions sorted by Activity, posting differently worded naive questions (mostly probably duplicates), answering a closed off-topic post with a paragraph answer obtained by first result of Google search using the question's keywords, and keep gaining reps with these activities.
- Once the bots have reached a reasonable threshold reps that provide them vote-casting security-rights, the hacker then issues a RPC to all the bots to down-vote the selected voting process.
Is programming such a bot possible? I think the above bot program would be an easy script for the hacker, and he might be executing all the the above steps as a pseudo-human bot because Optical Character Recognition (OCR) software is already there, along with web-simulation tools. It's just like arranging the pieces together in the script to achieve the bot-engine functionality.
What are the security checks and firewalls on SE which prevent such bots? How would you identity whether such bots are running in the system, if any? If you are assigned to specifically check for a dormant bot, which is currently in deep hyper-sleep, but which can become active later at any unpredicted time, how do you proceed?
If you believe such bot programs don't exist, what makes you think programming them is so hard? What are the programming challenges involved in designing and implementation of such bot-engine?