Yeah, I'd think it would be more cost effective to record the API requests the apps send and simulate those. No way the servers can tell the difference (unless they update the API or something).
Comment on Photographer steps inside Vietnam’s shadowy ‘click farms’ | CNN
GreatBlueHeron@lemmy.ca 3 months ago
It blows my mind that they need to do this with physical phones. I would have thought they could virtualise/emulate everything needed.
LostXOR@fedia.io 3 months ago
abhibeckert@lemmy.world 3 months ago
API requests are usually encrypted with something along the lines of a JWT: jwt.io
If you don’t know the secret used to generate the HMAC signature (blue section of that website), then you can’t simulate the API request. And the secret is never transmitted.
LostXOR@fedia.io 3 months ago
I was thinking more of using a debugger to see the API calls the app is making before SSL, not intercepting them over the network. Getting the secret would be harder but I assume it's stored somewhere in the app or app data and could be extracted. I'd be surprised if social media apps are storing it in the TPM.
I guess it comes down to whether it's easier/cheaper to do all of the above than to just buy a bunch of physical phones.
circuscritic@lemmy.ca 3 months ago
Software can detect the hardware it’s being run on, I imagine that mass traffic detected from x86, or emulated Android, would trigger fraud alerts.
Additionally, phones are cheap and use a lot less power then the x86 cluster required to replicate that many “individual” users/devices.
thedirtyknapkin@lemmy.world 3 months ago
On top of that, they pay these people so little that it’s cheaper to hire 50 of them for a year than to hire one person to run an operation like that for the same time.
smileyhead@discuss.tchncs.de 3 months ago
You can always spoof what software sees, but I guess this hackery development of spoofing tools would be more expensive than doing it on physical phones.