![Page 1: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/1.jpg)
RT2WIN!How 50 lines of Python made me the luckiest guy on Twitter
![Page 2: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/2.jpg)
“No purchase necessary, enter as often as you want. So I am.”
![Page 3: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/3.jpg)
Introduction• I’m Hunter• Electrical & Computer Engineer• Working in Silicon Valley• Currently disrupting social local mobile big data analytics with
cloud based MapReduce deployments on Docker with Rust
![Page 4: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/4.jpg)
Origin• “Hey, there’s a ton of contests on Twitter. All you have to do to
enter them is retweet them…”
![Page 5: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/5.jpg)
xkcd.com
![Page 6: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/6.jpg)
![Page 7: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/7.jpg)
“How hard could it possibly be?”
• Step 1: Look for contests, retweet them• Step 2: Profit• Started with simple search terms at first
• “rt2win”, rt to win”, “rt 2 win”, “retweet to win”, etc• Used the Twitter API• Rate limit = /• So, retweet slower, add random delays
![Page 8: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/8.jpg)
+Beautiful Soup
![Page 9: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/9.jpg)
![Page 10: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/10.jpg)
![Page 11: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/11.jpg)
![Page 12: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/12.jpg)
Better solution• Turn the follow queue into a FIFO• Unfollow the 1st account when I follow the 2000th account• The amount of time it takes to enter 2000 contests that require
following is enough that the 1st contest is almost certainly over by then
• Side effect: I get more real followers because people follow back as a courtesy.
• My bot actually looks more legit now
![Page 13: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/13.jpg)
![Page 14: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/14.jpg)
Interesting interactions
![Page 15: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/15.jpg)
Forgot to change my name on one of my accounts that won the same contest as another one…
![Page 16: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/16.jpg)
Yes, I won this.
![Page 17: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/17.jpg)
Bots vs Bots
![Page 18: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/18.jpg)
![Page 19: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/19.jpg)
Someone offering a postcard signed by ME as a prize…
![Page 20: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/20.jpg)
Sometimes my bot was accidentally a jerk /
![Page 21: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/21.jpg)
![Page 22: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/22.jpg)
Guess who?
![Page 23: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/23.jpg)
Another false positive
![Page 24: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/24.jpg)
Another false positive
![Page 25: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/25.jpg)
The Haul
![Page 26: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/26.jpg)
![Page 27: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/27.jpg)
The full list:
hscott.net/winnings.txt
![Page 28: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/28.jpg)
Doing good
![Page 29: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/29.jpg)
But even this backfired…
![Page 30: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/30.jpg)
But even this backfired…
![Page 31: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/31.jpg)
People ask you for weird stuff
![Page 32: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/32.jpg)
![Page 33: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/33.jpg)
Stats• 165,000 contests entered• On average, 4 wins per day, every day
![Page 34: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/34.jpg)
Stats• 165,000 contests entered• On average, 4 wins per day, every day, for 9 months straight
![Page 35: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/35.jpg)
Stats• 165,000 contests entered• On average, 4 wins per day, every day, for 9 months straight• Most valuable prize: $4000 trip to Fashion Week in NYC
![Page 36: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/36.jpg)
Yes, I paid the taxes.
![Page 37: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/37.jpg)
Other attempts• Before I did this, there were at most a few people auto-entering
twitter contests• Couldn’t find any obvious examples • Did see some manual examples• Now a lot of people do it
• Or at least, they try
![Page 38: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/38.jpg)
Often imitated, never duplicated
![Page 39: DEF CON 24 Hacking Conference CON 24/DEF CON 24...•Used the Twitter API •Rate limit = / •So, retweet slower, add random delays + Beautiful Soup Better solution •Turn the follow](https://reader036.vdocuments.us/reader036/viewer/2022062920/5f026e827e708231d4043c12/html5/thumbnails/39.jpg)
How to keep me from winning• Take two seconds and read the feed of the winner
• It will usually be pretty obvious.• I made no attempt at stealth and still won. Some people do attempt
stealth and are much harder to catch• Make it hard to programmatically enter
• Add something that requires natural language processing• Consider running the contest on Facebook
• Much harder to make a fake but convincing profile• Tied to real identity
• Accept that people always try to game contests