how my botnet purchased millions of dollars in cars ... con 21/def con 21... · defeated the...
TRANSCRIPT
![Page 1: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/1.jpg)
DEFCON XXI
How my Botnet Purchased Millions of Dollars in Cars
& Defeated the Russian Hackers
![Page 2: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/2.jpg)
I want to tell you a story about...
● Hacking ● Cars ● Russian Hackers● Screwing with the system
![Page 3: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/3.jpg)
I want to tell you a story about...
● Commercial Botnets ● Creating competitive advantages ● Not using technology as directed
![Page 4: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/4.jpg)
What you'll learn
● What makes a good
Botnet / Webbot project? ● How Bots create competitive
advantages for business (example) ● What I would do differently today
(the example happened 6 years ago)
![Page 5: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/5.jpg)
What makes a good Bot project?
● The Bot... – Can't recreate Google – Must solve a problem– Be viable for it's service life– Doesn't “show it's hand”
![Page 6: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/6.jpg)
I have permission to tell this story.
● It's rare that I get to mention specific projects.
● I've been writing about bots since 1999– Medical diagnostics
– Privacy
– Fraud detection
– Private investigations
– Governments
![Page 7: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/7.jpg)
So the 1st thing I did, was write this..
PLAYING NICE WITHINTERNET ATTACKTECHNIQUES
UK Nov 2012US Dec 2012
![Page 8: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/8.jpg)
The Problem to be Solved
● Dealerships that sell new cars make most of their money on used vehicles.
● Automobile dealers spend a lot of time & money acquiring (previously owned) inventory.
● A client found a website that had great cars for sale.
● Unfortunately, due a lot of competition (and bad web design) he wasn't able to buy the cars he wanted.
![Page 9: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/9.jpg)
The Opportunity
● Daily, a national franchise posted about 300 rental returns for dealerships to purchase.
● They could view the cars before the sale.● No car could be purchased before 10AM PDT.
![Page 10: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/10.jpg)
The Opportunity
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
Before 10:00am
After 10:00am
![Page 11: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/11.jpg)
The Opportunity
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
Before 10:00am
After 10:00am
Users had to continually refresh their browser
to get this button to appear
![Page 12: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/12.jpg)
And here's the real problem.
If there are two hundred available cars...
![Page 13: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/13.jpg)
And here's the real problem.
About five cars will be highly desirable
![Page 14: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/14.jpg)
And here's the real problem.
Every franchised dealership...
![Page 15: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/15.jpg)
And here's the real problem.
Attempted to buy the same cars.
![Page 16: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/16.jpg)
What my client faced
● There were a limited number of “real deals”
● Every dealership wanted the same cars
● The website's design created peak bandwidth demands, that made the website very hard to use.
![Page 17: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/17.jpg)
How my client coped
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
While waitingfor this button
to appear...
● Car dealers would recruit every available person for this task.
● These people would be assigned to specific cars● They'd have multiple browser windows open● They'd keep hitting the browser refresh button until it was enabled
![Page 18: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/18.jpg)
How my client coped
MAKE Hudson MODEL 112 CoupeYEAR 1938MILES 47,000CONDITION Excellent
PRICE $18,500
While waitingfor this button
to appear...
● Car dealers would recruit every available person for this task.
● These people would be assigned to specific cars● They'd have multiple browser windows open● They'd keep hitting the browser refresh button until it was enabled
Every franchise(for this brand) did these things
![Page 19: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/19.jpg)
Site design caused a technical problem
● The bandwidth/server lag peaked at the sale time● It could take as long as 30 seconds for screens to refresh
TIME
BA
ND
WID
TH
Time of sale
![Page 20: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/20.jpg)
Site design caused a technical problem
● The bandwidth/server lag peaked at the sale time● It could take as long as 30 seconds for screens to refresh
TIME
BA
ND
WID
TH
Time of sale
The websiteWas basically unusable...if used as designed
![Page 21: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/21.jpg)
The client called and asked if a webbot could help.
![Page 22: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/22.jpg)
Solution, Part 1
Problems with existing system: 1. Was too manual
2. The “Buy” button took too long to appear
![Page 23: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/23.jpg)
Solution, Part 1
Problems with existing system: 1. Was too manual
2. The “Buy” button took too long to appear
Note:This was seven years
ago, and I don't developlike this anymore.
![Page 24: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/24.jpg)
Solution, Part 1
I developed a light weight web interface like this.
![Page 25: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/25.jpg)
Solution, Part 1
Each client was in anHTML frame.
Initially, we used four instances.
The client would oftenload the bot on multiple computers.
![Page 26: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/26.jpg)
Solution, Part 1
The first step was to validate the VIN
BOTCLIENT
BOTSERVER
TARGETSERVER
VIN VIN SEARCH
FOUND / NOT FOUNDGOOD / BAD
![Page 27: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/27.jpg)
Solution, Part 1
Once the VIN was validated, it waited for theclient to tell it to start.
![Page 28: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/28.jpg)
Solution, Part 1
BOTCLIENT
BOTSERVER
TARGETSERVER
SYNC REQ SERVER TIME
SERVER TIMETIMESTAMP
The Client Bot, then synchronized clocks with the TargetAnd started the count down to purchase.
![Page 29: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/29.jpg)
Solution, Part 1
Every now and then, we'd miss one.
![Page 30: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/30.jpg)
Solution, Part 1
But more often:
● The sale was successful, and● The Bot arranged for financing & shipping
![Page 31: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/31.jpg)
Success, Part 1BEFORE AFTER
SUCCESSFAILURE
The client's purchase success rate went from 0% to near 100%
![Page 32: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/32.jpg)
BOTSERVER
What accounted for the initial success?
BOTCLIENT
TARGETSERVER
PURCHASE ATTEMPT
BEFORE
BOTCLIENT
TARGETSERVERSALE ACTIVE
REFRESH
AFTER 12
639 TIMER
PURCHASE ATTEMPT
![Page 33: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/33.jpg)
BOTSERVER
BOTCLIENT
TARGETSERVER
PURCHASE ATTEMPT
BEFORE
BOTCLIENT
TARGETSERVERSALE ACTIVE
REFRESH
AFTER 12
639 TIMER
PURCHASE ATTEMPT
This got sloweras time of sale
got close
What accounted for the initial success?
![Page 34: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/34.jpg)
BOTSERVER
BOTCLIENT
TARGETSERVER
PURCHASE ATTEMPT
BEFORE
BOTCLIENT
TARGETSERVERSALE ACTIVE
REFRESH
AFTER 12
639 TIMER
PURCHASE ATTEMPT
The Bot was successfulprimarily because
it didn't have to waitto be told that the sale
was on.
What accounted for the initial success?
![Page 35: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/35.jpg)
A sign of problems
The client continued to have success for about six months.
● Suddenly, success rates dropped to about 50%
● My client discovered a competing bot developed by a group of Russian Hackers
● Competition is good, and leads to innovation.
![Page 36: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/36.jpg)
Solution, Part 2a
The clock synchronization was modified to make checks moreoften as the sale neared, and also calculated system lag.
BOTSERVER
BOTCLIENT
TARGETSERVER
Clock Sync
12
639 TIMER
SERVER TIME REQUEST
SERVER TIME
System lag(time req. to get Server clock)
![Page 37: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/37.jpg)
Solution, Part 2b
Purchases where attempted:
● The Bot Client triggered the Bot Server to make multiple attempts to buy the vehicle.
● Each attempt was made slightly prior to the actual sale time and based on calculated system delays.
BOTSERVER
BOTCLIENT
TARGETSERVER
Clock Sync
12
639 TIMER
BUY!
BUY! (t=t-n1)
BUY! (t=t-n2)
BUY! (t=t-n3)
BUY! (t=t-n4)
![Page 38: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/38.jpg)
How successful was this Bot?
● The Bot operated for about 40 weeks
● The client bought approximately 20 cars a week (estimated)
● Total cars purchased 800 (estimated)
● If the average wholesale cost ~$16,000
● The Bot purchased $12,800,00 (estimated wholesale value)
![Page 39: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/39.jpg)
What would I do differently?● What did it do well?
● More successful than anticipated● Very lightweight clients
● Easily updated● Easily distributed
![Page 40: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/40.jpg)
What would I do differently?● Fairly stealthy
● It required authenticated users● Affects stealthiness● Tried to simulate human behavior● Using multiple accounts
● The expected behavior was pretty weird
![Page 41: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/41.jpg)
What would I do differently?● Today, it would have to accommodate newer technology
● The sale website used standard HTML forms, which are easy to emulate (submit) with simple PHP scripts
● Today's websites are more suffocated● AJAX● Complex forms, etc.
![Page 42: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/42.jpg)
What would I do differently?● Vehicles could be written into a “task queue” via a web interface
to the BOT SERVER
BOTSERVER
WEBINTERFACE
TASK QUEUE
VIN STATUSJTHBW1GG3D2012782 PENDINGJTHBW1GG5D2021449 PENDINGJTHBW1GG6D2004871 PENDING
![Page 43: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/43.jpg)
What would I do differently?● Tasks in the Task Queue are distributed to individual computers
that I call harvesters.
BOTSERVER
TASK QUEUE
VIN STATUSJTHBW1GG3D2012782 PENDINGJTHBW1GG5D2021449 PENDINGJTHBW1GG6D2004871 PENDING... ...
HARVESTER
HARVESTER
HARVESTER
HARVESTER
HARVESTER
The harvesters may belocated anywhere
● Data Center● Office● Cloud
![Page 44: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/44.jpg)
What would I do differently?● The harvesters create (iMacros) browser macros on-the-fly
and execute commands directly in Firefox
BOTSERVER
HARVESTER
HARVESTER
HARVESTER
HARVESTER
HARVESTER
FIREFOX (iMacros) HARVESTER
FIREFOX (iMacros)
FIREFOX (iMacros)
FIREFOX (iMacros)
FIREFOX (iMacros)
TARGETSERVER
![Page 45: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/45.jpg)
What would I do differently?
Once the task is completed, the harvesters communicate backto the Bot Server, which updates the Task Queue.
BOTSERVER
TASK QUEUE
VIN STATUSJTHBW1GG3D2012782 BOUGHTJTHBW1GG5D2021449 FAILUREJTHBW1GG6D2004871 BOUGHT... ...
HARVESTER
HARVESTER
HARVESTER
HARVESTER
HARVESTER
The results in the TaskQueue are communicatedto The Client via a webinterface.
![Page 46: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/46.jpg)
What would I do differently?
Once the task is completed, the harvesters communicate backto the Bot Server, which updates the Task Queue.
BOTSERVER
TASK QUEUE
VIN STATUSJTHBW1GG3D2012782 BOUGHTJTHBW1GG5D2021449 FAILUREJTHBW1GG6D2004871 BOUGHT... ...
HARVESTER
HARVESTER
HARVESTER
HARVESTER
HARVESTER
The results in the TaskQueue are communicatedto The Client via a webinterface.
If you're interested inthe details of how this is done, look-up my DEFCON 17 talk.
Screen Scraper Tricks: Difficult cases
![Page 47: How my Botnet Purchased Millions of Dollars in Cars ... CON 21/DEF CON 21... · Defeated the Russian Hackers. ... So the 1st thing I did, was write this.. PLAYING NICE WITH INTERNET](https://reader035.vdocuments.site/reader035/viewer/2022071013/5fcb8340d98df67a9a6c84e1/html5/thumbnails/47.jpg)
SHOUTS
Thanks to All of You, the DEFCON CFP Goons (particularly Nikita) for allowing me to give my 5th
DEFCON talk.
If you like this type of talk, the rest of my talks are on YouTube.
– DEFCON X Developing Webbots & Agents
– DEFCON XI Corporate Intelligence
– DEFCON XV The Incredible Executable Image Exploit
– DEFCON XVII Advanced Scraping: Difficult Cases
( search “schrenk DEFCON” )
[email protected] www.schrenk.com