Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Hey everyone, I work in cybersecurity and just wanted to point out an issue in the implementation of EVGA's current anti-bot CAPTCHA implementation. The CAPTCHA at login is easily automated using tools like Selenium, PhantomJS or Puppeteer (to name basic ones) when it is only accepting the checkbox input. Selenium and other tools are great and blowing past those, obviously, since in my research the one EVGA has in use currently spawned the simple checkbox authentication majority of the time. The ones Selenium can not blow through are the "please check three fire hydrants or street lights". Tools like CAPTCHA and reCAPTCHA are only effective when utilized as a buffer since dedicated free tools are out there to defeat them (example 2Captcha). The harder to solve captchas appear if you're using recaptcha a lot. Generally, low frequency users should only see the checkbox and not need to solve captchas. This issue has been around for a bit meaning since you have tons of bots ready to pounce they will most likely get the easy checkbox instead of the ones that will actually keep the bots out. EVGA your team would do well to implement a cascading solution to slow down the automated web scrapers since unfortunately you can't force CAPTCHA to always use a challenge image every time so most of the time you give the bots the easy CAPTCHA to get in. To combat this the team could toss in the normal CAPTCHA at account login, a reCAPTCHA v2 at add to cart, and a final reCAPTCHA v3 at time of purchase just for launch days as an idea. This cascading solution will offer more chances to your customers that the bots will have a higher probability of hitting a solution the bot will stall on. I hope this information is helpful in the future and maybe for the RTX 3090 launch as well since this code is easy to add to the specific webpages. I'm new here and just wanted to offer up some help. Hope everyone has a wonderful day!
post edited by Unlox - 2020/09/17 09:51:09
|
GTXJackBauer
Omnipotent Enthusiast
- Total Posts : 10323
- Reward points : 0
- Joined: 2010/04/19 22:23:25
- Location: (EVGA Discount) Associate Code : LMD3DNZM9LGK8GJ
- Status: offline
- Ribbons : 48
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:06:50
(permalink)
Use this Associate Code at your checkouts or follow these instructions for Up to 10% OFF on all your EVGA purchases: LMD3DNZM9LGK8GJ
|
torick
Superclocked Member
- Total Posts : 118
- Reward points : 0
- Joined: 2013/04/10 04:10:09
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:13:26
(permalink)
Please do what Unlox is saying. This would help your user base actually be able to acquire your products and keep them happier.
|
m0camb0
New Member
- Total Posts : 6
- Reward points : 0
- Joined: 2020/09/17 07:47:21
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:15:21
(permalink)
As you work in cybersecurity, you must be aware that our work is always a compromise between convenience and security, adding 3 captchas adds a lot of inconvenience to legitimate users. As someone who's been in the sneaker resale market for a few years, bots are very advanced and are capable of mimicking true user behavior with mouse movement and other random actions which can be configured, all head-less as well.
What EVGA is doing right now(manual verification of orders), while tedious is the most effective way of detecting bots, especially when orders are not at a stage where they are in the thousands.
|
Delirious
EVGA Forum Moderator
- Total Posts : 17474
- Reward points : 0
- Joined: 2007/11/15 13:34:04
- Location: at my computer
- Status: offline
- Ribbons : 61
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:28:24
(permalink)
m0camb0
As you work in cybersecurity, you must be aware that our work is always a compromise between convenience and security, adding 3 captchas adds a lot of inconvenience to legitimate users. As someone who's been in the sneaker resale market for a few years, bots are very advanced and are capable of mimicking true user behavior with mouse movement and other random actions which can be configured, all head-less as well.
What EVGA is doing right now(manual verification of orders), while tedious is the most effective way of detecting bots, especially when orders are not at a stage where they are in the thousands.
and the captcha has deterred hundreds of attempts monthly of bots trying to spam the forum. It has drastically reduced such spam but a few do get through. May be a slight inconvenience to members who log in, but so is SPAM all over the forums.
"Be quick to listen, slow to speak and slow to anger" Affiliate Code XZUMV9TJW5 Associate Code: 7PM43CU71IB2IAP education may be expensive but wait until you get the bill for ignorance A wise man once said that we can't make anyone feel or do anything. We can throw things into the wind, but it's up to each person to decide how they want to react, where they want to stand when things fall.
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:30:17
(permalink)
m0camb0
As you work in cybersecurity, you must be aware that our work is always a compromise between convenience and security, adding 3 captchas adds a lot of inconvenience to legitimate users. As someone who's been in the sneaker resale market for a few years, bots are very advanced and are capable of mimicking true user behavior with mouse movement and other random actions which can be configured, all head-less as well.
What EVGA is doing right now(manual verification of orders), while tedious is the most effective way of detecting bots, especially when orders are not at a stage where they are in the thousands.
This could be implemented just on launch days and back to their default configuration for all the other days of the year. Win for launch day customers and back to easy purchasing for non-launch buyers.
post edited by Unlox - 2020/09/17 10:33:15
|
dalten22
Superclocked Member
- Total Posts : 133
- Reward points : 0
- Joined: 2017/10/29 00:24:54
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:33:32
(permalink)
OP there were probably at least 10000 people smashing F5 trying to buy a total of 50 cards max. Bots are just as empty clamped as everyone else.
|
d.burnette
CLASSIFIED ULTRA Member
- Total Posts : 5496
- Reward points : 0
- Joined: 2007/03/08 13:19:32
- Status: offline
- Ribbons : 17
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:35:51
(permalink)
Yeah anything that could be done to improve things for the general consumer (not scalpers) would be much appreciated. I so dread trying to get a 3090 FTW3 when they are available.
Don EVGA Z390 Dark MB | i9 9900k CPU @ 5.2 GHz all cores | EVGA RTX 3090 FTW3 Ultra | 32 GB G Skill Trident Z 3200 MHz CL14 DDR4 Ram | Corsair H150i Pro Cooler | EVGA T2 Titanium 1000w Power Supply | Samsung 970 Pro 1TB m.2 Nvme | Samsung 970 Evo 1TB m.2 Nvme | Samsung 860 Evo 1TB SATA SSD | EVGA DG 87 Case |
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:35:55
(permalink)
dalten22
OP there were probably at least 10000 people smashing F5 trying to buy a total of 50 cards max.
Oh I believe it, just wanted to speak up about the captcha thing however since I know it wasn’t all EVGA forum customers that purchased them. There definitely was a mass bot web scraping due to every other site experiencing it. Just some friendly suggestions for the team.
|
Intoxicus
iCX Member
- Total Posts : 406
- Reward points : 0
- Joined: 2009/10/23 19:03:35
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:37:33
(permalink)
Unlox
Hey everyone,
I work in cybersecurity and just wanted to point out an issue in the implementation of EVGA's current anti-bot CAPTCHA implementation. The CAPTCHA at login is easily automated using tools like Selenium, PhantomJS or Puppeteer (to name basic ones) when it is only accepting the checkbox input. Selenium and other tools are great and blowing past those, obviously, since in my research the one EVGA has in use currently spawned the simple checkbox authentication majority of the time. The ones Selenium can not blow through are the "please check three fire hydrants or street lights". Tools like CAPTCHA and reCAPTCHA are only effective when utilized as a buffer since dedicated free tools are out there to defeat them (example 2Captcha). The harder to solve captchas appear if you're using recaptcha a lot. Generally, low frequency users should only see the checkbox and not need to solve captchas. This issue has been around for a bit meaning since you have tons of bots ready to pounce they will most likely get the easy checkbox instead of the ones that will actually keep the bots out.
EVGA your team would do well to implement a cascading solution to slow down the automated web scrapers since unfortunately you can't force CAPTCHA to always use a challenge image every time so most of the time you give the bots the easy CAPTCHA to get in. To combat this the team could toss in the normal CAPTCHA at account login, a reCAPTCHA v2 at add to cart, and a final reCAPTCHA v3 at time of purchase just for launch days as an idea. This cascading solution will offer more chances to your customers that the bots will have a higher probability of hitting a solution the bot will stall on. I hope this information is helpful in the future and maybe for the RTX 3090 launch as well since this code is easy to add to the specific webpages.
I'm new here and just wanted to offer up some help. Hope everyone has a wonderful day!
Damn, I thought Captcha was better than that? Didn't realize it could be fooled that easily.
"Humans are not rational animals, humans are rationalizing animals." -Robert A Heinlein
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:39:17
(permalink)
Intoxicus
Unlox
Hey everyone,
I work in cybersecurity and just wanted to point out an issue in the implementation of EVGA's current anti-bot CAPTCHA implementation. The CAPTCHA at login is easily automated using tools like Selenium, PhantomJS or Puppeteer (to name basic ones) when it is only accepting the checkbox input. Selenium and other tools are great and blowing past those, obviously, since in my research the one EVGA has in use currently spawned the simple checkbox authentication majority of the time. The ones Selenium can not blow through are the "please check three fire hydrants or street lights". Tools like CAPTCHA and reCAPTCHA are only effective when utilized as a buffer since dedicated free tools are out there to defeat them (example 2Captcha). The harder to solve captchas appear if you're using recaptcha a lot. Generally, low frequency users should only see the checkbox and not need to solve captchas. This issue has been around for a bit meaning since you have tons of bots ready to pounce they will most likely get the easy checkbox instead of the ones that will actually keep the bots out.
EVGA your team would do well to implement a cascading solution to slow down the automated web scrapers since unfortunately you can't force CAPTCHA to always use a challenge image every time so most of the time you give the bots the easy CAPTCHA to get in. To combat this the team could toss in the normal CAPTCHA at account login, a reCAPTCHA v2 at add to cart, and a final reCAPTCHA v3 at time of purchase just for launch days as an idea. This cascading solution will offer more chances to your customers that the bots will have a higher probability of hitting a solution the bot will stall on. I hope this information is helpful in the future and maybe for the RTX 3090 launch as well since this code is easy to add to the specific webpages.
I'm new here and just wanted to offer up some help. Hope everyone has a wonderful day!
Damn, I thought Captcha was better than that?
Didn't realize it could be fooled that easily.
Yeah it’s pretty wild! Go and google “Force challenge image for captcha” you’ll find many people that explain how there is not a flag to force captcha behavior it’s wild. Plus selenium and others can easily fool the checkbox captcha.
post edited by Unlox - 2020/09/17 10:41:31
|
GTXJackBauer
Omnipotent Enthusiast
- Total Posts : 10323
- Reward points : 0
- Joined: 2010/04/19 22:23:25
- Location: (EVGA Discount) Associate Code : LMD3DNZM9LGK8GJ
- Status: offline
- Ribbons : 48
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:40:10
(permalink)
Unlox
dalten22
OP there were probably at least 10000 people smashing F5 trying to buy a total of 50 cards max.
Oh I believe it, just wanted to speak up about the captcha thing however since I know it wasn’t all EVGA forum customers that purchased them. There definitely was a mass bot web scraping due to every other site experiencing it. Just some friendly suggestions for the team.
I'm no expert but it's clearly obvious something went on this morning not just from one or two e-tailers but several of them all at once. I say make it a federal offense if you're caught scalping and botting. 
post edited by GTXJackBauer - 2020/09/17 10:49:49
Use this Associate Code at your checkouts or follow these instructions for Up to 10% OFF on all your EVGA purchases: LMD3DNZM9LGK8GJ
|
q5sys
Superclocked Member
- Total Posts : 153
- Reward points : 0
- Joined: 2016/09/02 10:55:23
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:46:54
(permalink)
|
GTXJackBauer
Omnipotent Enthusiast
- Total Posts : 10323
- Reward points : 0
- Joined: 2010/04/19 22:23:25
- Location: (EVGA Discount) Associate Code : LMD3DNZM9LGK8GJ
- Status: offline
- Ribbons : 48
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:50:14
(permalink)
Use this Associate Code at your checkouts or follow these instructions for Up to 10% OFF on all your EVGA purchases: LMD3DNZM9LGK8GJ
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:51:51
(permalink)
q5sys
GTXJackBauer
Unlox
dalten22
OP there were probably at least 10000 people smashing F5 trying to buy a total of 50 cards max.
Oh I believe it, just wanted to speak up about the captcha thing however since I know it wasn’t all EVGA forum customers that purchased them. There definitely was a mass bot web scraping due to every other site experiencing it. Just some friendly suggestions for the team.
I'm no expert but it's clearly obvious something went on this morning not just from one or two e-tailers but several of them all at once.
I say make it a federal offense if you're caught scalping.
People are bragging about using BounceAlerts Bot to buy cards through the Nvidia store, note the number of emails in the threads
42x
34x
17x
18x
14x
Im sure similar things went down elsewhere
I figured as much. There is too much money for them to make by taking advantage of the system. It's why I decided to make this post because there are multiple ways to slow down this behavior I just mentioned one off the top of my head. Maybe EVGA can PM me if they want to discuss more approaches.
|
rblaes_99
FTW Member
- Total Posts : 1951
- Reward points : 0
- Joined: 2007/02/17 06:25:20
- Status: offline
- Ribbons : 15
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 10:55:57
(permalink)
in the state oh Ohio, rare bourbons never used to make it to the retail shelves and were being snapped up and traded backdoor at a huge markup on the grey market. THe Ohio department of commerce came up with a simple way to combat this by creating a "bottle lottery" tied to an individuals drivers license number (so you can only enter once) and if you are randomly selected you simply "win" the right to buy the product at the MSRP price. You are also legally bound not to resell the item and if caught will not be allowed to enter future lotteries and may be charged with black-marketing. https://liqagency.com.ohio.gov/bottlelottery.aspx Creating a "new release" lottery would eliminate all of this nonsense. The "winners" could be drawn a month or a week, or a damn day in advance and it would be done. no f5 spamming, no ebay scalpers, no websites crashing when people are checking out. Everyone that is legit would have a single entry and a fair chance in a lottery. Hell EVGA, even charge a "processing and verification" fee to enter the lottery and donate it to a children's hospital or something.
|
zeroseoul
Superclocked Member
- Total Posts : 109
- Reward points : 0
- Joined: 2013/01/26 20:04:43
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 11:16:23
(permalink)
In all fairness, bots will almost always get around whatever process you have. Take it from sneaker releases, it never got solved.
There is always a question of what level of control is the best level?
We could go around and throw this or that at each other but in all honesty, its the luck of the draw. It sucks, yeah, but not everyone can win in a scenario with finite resources.
Current Build: CPU: Intel i7-8770k @ stock speeds Motherboard: ASUS PRIME z370-A Memory: 16 GB Corsair Vengence GPU: GTX 970 FTW Power Supply: EVGA Supernova 750G2
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 11:20:01
(permalink)
zeroseoul
In all fairness, bots will almost always get around whatever process you have. Take it from sneaker releases, it never got solved.
There is always a question of what level of control is the best level?
We could go around and throw this or that at each other but in all honesty, its the luck of the draw. It sucks, yeah, but not everyone can win in a scenario with finite resources.
I wouldn’t say luck is involved when these specialized programs can poll the in-stock rate down to the millisecond and then execute and make the purchase (to put it in layman’s terms). The chances are effectively nill for normal people vs bots. It’s like saying it’s down to luck if Usain Bolt challenged you to a race. There is clearly an imbalance there that needs to be rectified. It can’t be fixed in this situation but you can slow them down to give others a proper chance. Special rate-limiting strategies could also be leveraged to help EVGAs customers out as well as other things.
post edited by Unlox - 2020/09/17 11:29:36
|
zeroseoul
Superclocked Member
- Total Posts : 109
- Reward points : 0
- Joined: 2013/01/26 20:04:43
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 11:46:23
(permalink)
Unlox
zeroseoul
In all fairness, bots will almost always get around whatever process you have. Take it from sneaker releases, it never got solved.
There is always a question of what level of control is the best level?
We could go around and throw this or that at each other but in all honesty, its the luck of the draw. It sucks, yeah, but not everyone can win in a scenario with finite resources.
I wouldn’t say luck is involved when these specialized programs can poll the in-stock rate down to the millisecond and then execute and make the purchase (to put it in layman’s terms). The chances are effectively nill for normal people vs bots.
It’s like saying it’s down to luck if Usain Bolt challenged you to a race. There is clearly an imbalance there that needs to be rectified. It can’t be fixed in this situation but you can slow them down to give others a proper chance.
Special rate-limiting strategies could also be leveraged to help EVGAs customers out as well as other things.
Sure, I get it, it takes seconds for a bot to run lets say a simple cURL request to see if a product is available then initiate the right combination of things via proxies to submit an order. Granted all of these things are still based off return time and response to the servers in question. Within a pipe there are X number of connections available, sure the bots could be there faster. The biggest question is: where is the correct balance? Some security features come with heavy resource costs, many of which won't scale to the thousands if not 10's of thousands hitting a site. Some security features take too long, maybe you were quick but someone finished their questions before you and are now inline with the payment processor before you. EVGA and GPU Companies deal with this very rarely and periodically. Shoe companies deal with this on a week to week and monthly basis. There are serious limitations and problems in trying to scale solutions that can cover the amount of traffic these guys are getting hit with in a single minute. For instance, the reason why DDoS is still a thing is because we can't prevent it, there's no way to effectively handle large traffic, once a DDoS happens, its a scramble, not a magic switch. Lastly, there could be better ways to help customers. But how do you distinguish who is a seller and a user? What if I bought a Bot to guarantee a purchase because I'm a avid gamer? Theres too many what if's here to be honest.
Current Build: CPU: Intel i7-8770k @ stock speeds Motherboard: ASUS PRIME z370-A Memory: 16 GB Corsair Vengence GPU: GTX 970 FTW Power Supply: EVGA Supernova 750G2
|
GTXJackBauer
Omnipotent Enthusiast
- Total Posts : 10323
- Reward points : 0
- Joined: 2010/04/19 22:23:25
- Location: (EVGA Discount) Associate Code : LMD3DNZM9LGK8GJ
- Status: offline
- Ribbons : 48
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 11:58:12
(permalink)
You both make valid points.
It's clearly a lose-lose situation for the few while others patiently wait since they are accustomed to the same ol song on next gen releases. It will take up to 2-3 months till stocks normalize iirc, that's if 'Rona' makes no impact. In the meantime my best advise to those waiting, be patient.
Use this Associate Code at your checkouts or follow these instructions for Up to 10% OFF on all your EVGA purchases: LMD3DNZM9LGK8GJ
|
the_Scarlet_one
formerly Scarlet-tech
- Total Posts : 24581
- Reward points : 0
- Joined: 2013/11/13 02:48:57
- Location: East Coast
- Status: offline
- Ribbons : 79
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:10:33
(permalink)
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:19:11
(permalink)
zeroseoul
Unlox
zeroseoul
In all fairness, bots will almost always get around whatever process you have. Take it from sneaker releases, it never got solved.
There is always a question of what level of control is the best level?
We could go around and throw this or that at each other but in all honesty, its the luck of the draw. It sucks, yeah, but not everyone can win in a scenario with finite resources.
I wouldn’t say luck is involved when these specialized programs can poll the in-stock rate down to the millisecond and then execute and make the purchase (to put it in layman’s terms). The chances are effectively nill for normal people vs bots.
It’s like saying it’s down to luck if Usain Bolt challenged you to a race. There is clearly an imbalance there that needs to be rectified. It can’t be fixed in this situation but you can slow them down to give others a proper chance.
Special rate-limiting strategies could also be leveraged to help EVGAs customers out as well as other things.
Sure, I get it, it takes seconds for a bot to run lets say a simple cURL request to see if a product is available then initiate the right combination of things via proxies to submit an order. Granted all of these things are still based off return time and response to the servers in question. Within a pipe there are X number of connections available, sure the bots could be there faster.
The biggest question is: where is the correct balance? Some security features come with heavy resource costs, many of which won't scale to the thousands if not 10's of thousands hitting a site. Some security features take too long, maybe you were quick but someone finished their questions before you and are now inline with the payment processor before you.
EVGA and GPU Companies deal with this very rarely and periodically. Shoe companies deal with this on a week to week and monthly basis. There are serious limitations and problems in trying to scale solutions that can cover the amount of traffic these guys are getting hit with in a single minute. For instance, the reason why DDoS is still a thing is because we can't prevent it, there's no way to effectively handle large traffic, once a DDoS happens, its a scramble, not a magic switch.
Lastly, there could be better ways to help customers. But how do you distinguish who is a seller and a user? What if I bought a Bot to guarantee a purchase because I'm a avid gamer? Theres too many what if's here to be honest.
This all comes down to what EVGA wants to do and what they value. If it's just all about raw sales for them, then they are doing great and none of this matters. At the end of the day, it's up to them, but they do have real tangible options. I do think this entire situation was made worse by NVIDIA not allowing AIBs to take preorders but we all know that is due to manufacturing being impacted by COVID-19. Either way they will get more in stock soon and hopefully everyone gets what they were looking forward to.
|
kevinc313
CLASSIFIED ULTRA Member
- Total Posts : 5004
- Reward points : 0
- Joined: 2019/02/28 09:27:55
- Status: offline
- Ribbons : 22
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:30:26
(permalink)
|
q5sys
Superclocked Member
- Total Posts : 153
- Reward points : 0
- Joined: 2016/09/02 10:55:23
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:30:50
(permalink)
the_Scarlet_one
q5sys
People are bragging about using BounceAlerts Bot to buy cards through the Nvidia store, note the number of emails in the threads
42x https://mobile.twitter.co...us/1306621909413502976
34x https://mobile.twitter.co...us/1306644324160090112
17x https://mobile.twitter.co...us/1306629763927171072
18x https://mobile.twitter.co...us/1306618636480778246
14x https://mobile.twitter.co...us/1306615634361376768
Im sure similar things went down elsewhere
I have never seen anything like this. Now everyone needs to barrage NVidia specifically about this, as all of the BounceAlerts sales are showing from NVidia store, and see about getting these accounts banned. If other stores had be hit this way, I would assume other would show which stores were hit as well.
I really hope NVidia would cancel all of these orders in mass, and ban the account of the users that used a bot. NVidia could easily, and I really regret saying this, force people to use GEForce Experience to sell the cards, and verify the user. This would allow NVidia to ban any user that buys more than the allotted cards in a set amount of time, or perma ban those that are obviously screwing others out of the ability to purchase.
This has been a legit problem with other industries. The one most people know of is Sneakers Releases, but it happens with tons of items. There are a couple automation purchase systems that I'm aware of with all sorts of modules for various retailers. krs is another one. People use them to buy from all sorts of retails when there is a limited edition of anything coming out. Anyone can technically pay and sign up, get linked into the system and then use whatever accounts they want at whatever retailers. The main issue is that some developers have turned creating these systems into a career. Monthly subscriptions to these services keep money flowing in for them to continue to work against any limitations that are developed by retailers. It doesn't even require tech skill for an end user to utilize them, just find out about these services and pay the monthly fee. Depending on how much money you want to throw at it, you can order 1 or 20 of something to flip quickly for profit. Repeat the next month when the next industry has a release. While one individual industry may have only one or two big launches a year, there's so many retail industries that there is constant 'limited release' items coming out every month. I have a friend that uses krs for buying shoes for himself and his fam. He doesn't use it for flipping goods, just being able to make sure he gets what he wants. The individual sales will use the individual user accounts, the bouncealert people are simply building the infrastructure to do it. Lets say JohnQPublic signed up and bought 10 cards from some retailer, even if lets say NewEgg bans his account... that person can create a new account to use for the next big launch. There is no BounceAlert account for NewEgg to ban. The developers of BA and KRS, are using the same retail method of ordering, but its all scripted... with variables so their clients can input their own details for payment/shipping. Scripting is just way than a normal human and since its all being run in a datacenter... the system running the scripts has way better site response time from retail servers than what regular consumers would have.
post edited by q5sys - 2020/09/17 12:33:36
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:37:36
(permalink)
q5sys
the_Scarlet_one
q5sys
People are bragging about using BounceAlerts Bot to buy cards through the Nvidia store, note the number of emails in the threads
42x
34x
17x
18x
14x
Im sure similar things went down elsewhere
I have never seen anything like this. Now everyone needs to barrage NVidia specifically about this, as all of the BounceAlerts sales are showing from NVidia store, and see about getting these accounts banned. If other stores had be hit this way, I would assume other would show which stores were hit as well.
I really hope NVidia would cancel all of these orders in mass, and ban the account of the users that used a bot. NVidia could easily, and I really regret saying this, force people to use GEForce Experience to sell the cards, and verify the user. This would allow NVidia to ban any user that buys more than the allotted cards in a set amount of time, or perma ban those that are obviously screwing others out of the ability to purchase.
This has been a legit problem with other industries. The one most people know of is Sneakers Releases, but it happens with tons of items. There are a couple automation purchase systems that I'm aware of with all sorts of modules for various retailers. krs is another one. People use them to buy from all sorts of retails when there is a limited edition of anything coming out.
Anyone can technically pay and sign up, get linked into the system and then use whatever accounts they want at whatever retailers. The main issue is that some developers have turned creating these systems into a career. Monthly subscriptions to these services keep money flowing in for them to continue to work against any limitations that are developed by retailers. It doesn't even require tech skill for an end user to utilize them, just find out about these services and pay the monthly fee. Depending on how much money you want to throw at it, you can order 1 or 20 of something to flip quickly for profit. Repeat the next month when the next industry has a release. While one individual industry may have only one or two big launches a year, there's so many retail industries that there is constant 'limited release' items coming out every month. I have a friend that uses krs for buying shoes for himself and his fam. He doesn't use it for flipping goods, just being able to make sure he gets what he wants.
The individual sales will use the individual user accounts, the bouncealert people are simply building the infrastructure to do it. Lets say JohnQPublic signed up and bought 10 cards from some retailer, even if lets say NewEgg bans his account... that person can create a new account to use for the next big launch. There is no BounceAlert account for NewEgg to ban. The developers of BA and KRS, are using the same retail method of ordering, but its all scripted... with variables so their clients can input their own details for payment/shipping. Scripting is just way than a normal human and since its all being run in a datacenter... the system running the scripts has way better site response time from retail servers than what regular consumers would have.
In all honesty, the average user would have a better chance to get their item versus the bots if it was done in a raffle format lol but yeah it is very one-sided. Kind of a digital survival of the fittest, if you can code then you have a shot.
|
m0camb0
New Member
- Total Posts : 6
- Reward points : 0
- Joined: 2020/09/17 07:47:21
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:37:49
(permalink)
the_Scarlet_one
q5sys
People are bragging about using BounceAlerts Bot to buy cards through the Nvidia store, note the number of emails in the threads
42x
34x
17x
18x
14x
Im sure similar things went down elsewhere
I have never seen anything like this. Now everyone needs to barrage NVidia specifically about this, as all of the BounceAlerts sales are showing from NVidia store, and see about getting these accounts banned. If other stores had be hit this way, I would assume other would show which stores were hit as well.
I really hope NVidia would cancel all of these orders in mass, and ban the account of the users that used a bot. NVidia could easily, and I really regret saying this, force people to use GEForce Experience to sell the cards, and verify the user. This would allow NVidia to ban any user that buys more than the allotted cards in a set amount of time, or perma ban those that are obviously screwing others out of the ability to purchase.
This is just the tip of the iceberg, the resell community is deep and you get their attention when scarcity is brought up. Referring to the pics, they are most likely using multiple accounts with a catch-all email and addresses with variations to give the illusion of being unique. The only way other websites have been successful has been through pre-authorized payment with a raffle system. END-clothing does that for all limited clothing/shoe releases and it works quite well.
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 12:54:59
(permalink)
Looks like NVIDIA is doing a manual review:
www.pcmag.com/news/nvidia-is-manually-reviewing-rtx-3080-orders-to-stop-scalpers
|
the_Scarlet_one
formerly Scarlet-tech
- Total Posts : 24581
- Reward points : 0
- Joined: 2013/11/13 02:48:57
- Location: East Coast
- Status: offline
- Ribbons : 79
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 13:06:38
(permalink)
Unlox
Looks like NVIDIA is doing a manual review:
www.pcmag.com/news/nvidia-is-manually-reviewing-rtx-3080-orders-to-stop-scalpers
Good! Put a human factor in the mix that a bot can not bypass!
|
Intoxicus
iCX Member
- Total Posts : 406
- Reward points : 0
- Joined: 2009/10/23 19:03:35
- Status: offline
- Ribbons : 0
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 13:07:46
(permalink)
Unlox
Intoxicus
Unlox
Hey everyone,
I work in cybersecurity and just wanted to point out an issue in the implementation of EVGA's current anti-bot CAPTCHA implementation. The CAPTCHA at login is easily automated using tools like Selenium, PhantomJS or Puppeteer (to name basic ones) when it is only accepting the checkbox input. Selenium and other tools are great and blowing past those, obviously, since in my research the one EVGA has in use currently spawned the simple checkbox authentication majority of the time. The ones Selenium can not blow through are the "please check three fire hydrants or street lights". Tools like CAPTCHA and reCAPTCHA are only effective when utilized as a buffer since dedicated free tools are out there to defeat them (example 2Captcha). The harder to solve captchas appear if you're using recaptcha a lot. Generally, low frequency users should only see the checkbox and not need to solve captchas. This issue has been around for a bit meaning since you have tons of bots ready to pounce they will most likely get the easy checkbox instead of the ones that will actually keep the bots out.
EVGA your team would do well to implement a cascading solution to slow down the automated web scrapers since unfortunately you can't force CAPTCHA to always use a challenge image every time so most of the time you give the bots the easy CAPTCHA to get in. To combat this the team could toss in the normal CAPTCHA at account login, a reCAPTCHA v2 at add to cart, and a final reCAPTCHA v3 at time of purchase just for launch days as an idea. This cascading solution will offer more chances to your customers that the bots will have a higher probability of hitting a solution the bot will stall on. I hope this information is helpful in the future and maybe for the RTX 3090 launch as well since this code is easy to add to the specific webpages.
I'm new here and just wanted to offer up some help. Hope everyone has a wonderful day!
Damn, I thought Captcha was better than that?
Didn't realize it could be fooled that easily.
Yeah it’s pretty wild! Go and google “Force challenge image for captcha” you’ll find many people that explain how there is not a flag to force captcha behavior it’s wild. Plus selenium and others can easily fool the checkbox captcha.
Wow, mind blown. Had no idea how much Captcha oversells how good they are. Is it really that easy?
"Humans are not rational animals, humans are rationalizing animals." -Robert A Heinlein
|
Unlox
New Member
- Total Posts : 25
- Reward points : 0
- Joined: 2014/05/02 08:58:17
- Status: offline
- Ribbons : 1
Re: EVGA Team, Please implement a more robust anti-bot solution [ Possible solutions ]
2020/09/17 13:21:48
(permalink)
Intoxicus
Unlox
Intoxicus
Unlox
Hey everyone,
I work in cybersecurity and just wanted to point out an issue in the implementation of EVGA's current anti-bot CAPTCHA implementation. The CAPTCHA at login is easily automated using tools like Selenium, PhantomJS or Puppeteer (to name basic ones) when it is only accepting the checkbox input. Selenium and other tools are great and blowing past those, obviously, since in my research the one EVGA has in use currently spawned the simple checkbox authentication majority of the time. The ones Selenium can not blow through are the "please check three fire hydrants or street lights". Tools like CAPTCHA and reCAPTCHA are only effective when utilized as a buffer since dedicated free tools are out there to defeat them (example 2Captcha). The harder to solve captchas appear if you're using recaptcha a lot. Generally, low frequency users should only see the checkbox and not need to solve captchas. This issue has been around for a bit meaning since you have tons of bots ready to pounce they will most likely get the easy checkbox instead of the ones that will actually keep the bots out.
EVGA your team would do well to implement a cascading solution to slow down the automated web scrapers since unfortunately you can't force CAPTCHA to always use a challenge image every time so most of the time you give the bots the easy CAPTCHA to get in. To combat this the team could toss in the normal CAPTCHA at account login, a reCAPTCHA v2 at add to cart, and a final reCAPTCHA v3 at time of purchase just for launch days as an idea. This cascading solution will offer more chances to your customers that the bots will have a higher probability of hitting a solution the bot will stall on. I hope this information is helpful in the future and maybe for the RTX 3090 launch as well since this code is easy to add to the specific webpages.
I'm new here and just wanted to offer up some help. Hope everyone has a wonderful day!
Damn, I thought Captcha was better than that?
Didn't realize it could be fooled that easily.
Yeah it’s pretty wild! Go and google “Force challenge image for captcha” you’ll find many people that explain how there is not a flag to force captcha behavior it’s wild. Plus selenium and others can easily fool the checkbox captcha.
Wow, mind blown.
Had no idea how much Captcha oversells how good they are.
Is it really that easy?
Oh yeah, it’s even profitable! www.2captcha.com as an example, it’s why I said you can't stop it but you can slow them down.
post edited by Unlox - 2020/09/17 13:44:06
|