Slashdot Mirror
Gaming Foursquare With 9 Lines of Perl
caffeinemessiah writes "With the recent launch of Facebook Places, the rise to prominence of Foursquare and GoWalla, and articles in the New York Times about the increasing popularity of 'checking in' to locations using GPS-enabled mobile phones, a number of businesses are wondering how to reward frequent patrons. But exactly how susceptible are these 'location based services' to being abused? A researcher at the University of Illinois at Chicago shows how easily Foursquare can be gamed in 9 Perl statements, and invites readers to submit more succinct versions of the code to game the system."
An anonymous reader contributes a link to a similar article about spoofing Facebook Places to create an alibi.
I am happy that this is taking off. It's the only way we can fight back against data hoarders.
I propose SOCIAL PHREAKING: We need a P2P client that pretends to be a user of a social network: twitter, facebook, linked in, whatever. The software will login periodically (each client does it at a different rate, in fact, they negotiate.)
The idea is, the various fake accounts form relationships with one another. Every now and then they create a new account and share passwords where they login and 'appear to login' to be from a different location. The growth should be such that it is not suspicious and not an abuse of service. It would make more sense for every node to have only 1 or 2 accounts at most, to simulate families with accounts per family member.
With enough privacy advocates on the phreaknet should be able to generate enough traffic and data to distort the demographics at least slightly. We could make poison the data hoarders to make them think that everyone loves a certain brand of ice cream and then it would become more popular.
We can restore the tip of knowledge and power to ourselves.
Foursquare isn't useful for anything important.
How long before Julian Assange is proven (through his Facebook account) to have been at a McDonald's in Seattle when the alleged assault took place?
Not like there's going to be lots of fancy safeguards to try to prevent you from faking the GPS coordinates - which can come from a device in your control.
I think it was obvious to many from the start that it could be gamed, but most of those same people aren't interested in gaming it.
The other hilarious hack is fakemayor.com - all it does is fakes the screenshot so you can get the free beer or whatever. Expect more of this stuff as these checkin apps proliferate and the mayorship becomes more valuable.
Honestly, this is like saying that a poem is "two sentences" - totally meaningless. Now, if he had said 9 lines of pseudocode ...
"If srand() is not called explicitly, it is called implicitly at the first use of the "rand" operator." -- perldoc -f rand
:)
So there is a wasted line right there. This whole thing is quite silly, though. perlgolf can be a lot more challenging and fun than making a simple http post.
apparently, this has already been cancelled http://www.bbc.co.uk/news/world-europe-11049316
How long before someone gets it down to five lines?
#!/usr/bin/perl -W
use IO::Socket;
srand;
sleep(rand()*600);
my $sock = IO::Socket::INET->new(PeerAddr=>'api.foursquare.com', PeerPort=>80,
Proto =>'tcp', Type=>SOCK_STREAM) or die;
$ARGV[1] += rand() * 0.0001 - 0.00005;
$ARGV[2] += rand() * 0.0001 - 0.00005;
my $str = "vid=$ARGV[0]&private=0&geolat=$ARGV[1]&geolong=$ARGV[2]";
print $sock "POST
length($str)+2, "\r\n\r\n$str\r\n";
$_=;
The author didn't really even try, so it'll be easy to shorten it. Shortening it a lot is left as further exercise. I'll just get rid of some low-hanging fruit. I'm sure Perlmonks will pick up the challenge if they haven't already.
#!/usr/bin/perl -W
use IO::Socket;
sleep(rand()*600);
my $sock = IO::Socket::INET->new(PeerAddr=>'api.foursquare.com', PeerPort=>80,
Proto =>'tcp', Type=>SOCK_STREAM) or die;
my $str = "vid=$ARGV[0]&private=0&geolat=" . ($ARGV[1] += rand() * 0.0001 - 0.00005)
. "&geolong=" . ($ARGV[2] += rand() * 0.0001 - 0.00005);
print $sock "POST
. " Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ "
length($str)+2, "\r\n\r\n$str\r\n";
Five logical lines. Actual display lines may of course be different depending upon several factors like attempting to break long lines for viewing and the vagaries of the textual mangling on Slashdot.
Foursquare is a mobile application that makes cities easier to use and more interesting to explore. It is a friend-finder, a social city guide and a game that challenges users to experience new things, and rewards them for doing so. Foursquare lets users "check in" to a place when they're there, tell friends where they are and track the history of where they've been and who they've been there with. For more information on how foursquare works, see our searchable FAQ. http://foursquare.com/about
...we can't have nice things.
Yeah, foursquare is a cute little idea, but if people don't play nicely it'll suck. And with current GPS and locational technologies, it'll always be open to abuse.
Also, I reckon this is how Agent Smith managed to appear a zillion times in the same location.
http://carnal0wnage.blogspot.com/2010/03/fking-with-foursquare-goes-msf-style.html
Wow ... reading all that was really stressful ... too bad there isn't a source for stress relief that is easily accessible. sigh
Firefox allows you to fake your geolocation: http://pugio.net/2009/07/fake-your-geolocation-in-firef.html
> NOTE: To get this script to work, you must replace XXXXXX with the Base64
> encoded version of "email/phone:password", so base64("john@doe.com:mypassword").
> Here's Google's top ranked site for online Base64 encoding.
Yeah, what should go wrong by running your email/password-combo through a server-side Base64 encoder.
Did any body else catch that the Foursquare API has you sending your username and password in the clear?
Please tell me you can do all this on port 443 and that your phone is using SSL.
That said, I love it!
It has been shown many times and it has been shown again: Web 1.0, with all of the glorious unreadable Perl stuff, neatly and cleanly defeats all this Ruby on Rails, gradients-and-rounded-corners, Twitter-compatible, "beta" Web 2.0 nonsense!
...or maybe Web 2.0 people should stop designing RESTful asynchronous JavaScript-compatible social-media APIs that are too easily abused. It's not that hard!
(This was supposed to be a humorous post, but it's not really working today, is it?)
Ruby first round:
I'm certain Ruby golfers could shorten this significantly too.The "Content-length" and "Host" headers may be redundant--I'm not sure if Net::HTTP adds them automagically or not.
You can do that with 1 line of shell + wget/curl
Wouldn't a better hack be to spoof the location reported by your phone? After all, if the feds subpoena your cell phone records & get your actual location, wouldn't that destroy your foursquare/facebook alibi (as well as making you look more suspicious)?
To route burglaries. I no longer need to sit outside in my El Camino watching people and trying to guess when they will be gone. no all I need is a entry level programmer to parse all the "places" info in my target area. No longer will our street crew need to be on the street surveilling.
I do not play in the middle of the road
I did a simple Wireshark session with Foursquare's iPhone app and found they're sending my username and password in plain text over HTTP - they don't encrypt anything at all and they do it every time you open the Foursquare app.
You can see the Wireshark screenshot at my : blog post.
I'm removing the Foursquare app from my iPhone now. It's way too dangerous.
cause \r\n isn't \015\012 on every platform
Is it just me, or was $ARGV[0] never initialized? I wonder what 'vid' stands for?
You don't need a proxy or perl to game facebook places... you can do it by changing one line in your about:config and hard code "geo.wifi.uri"
I wrote up a full tutorial on my blog for those who are interested.
So how do you go about feeding these arguments into the script to actually check in with a venue ID, lat and long?
How do you enter in ARGV0? do you have to run this from a web page? or can you do this from command line.
how does the script find your geolat and geolong?
The only even remotely common one where it isn't is Mac OS Classic (i.e. pre-OSX), nowadays. (Although Windows will convert \n into \r\n on output to a textmode file, this will happen whether it's written as \015\012 or \r\n.) So you don't really gain anything by doing this. (A better method is to set the "binary mode" flag on the filehandle, e.g. by using "binmode" in Perl, in order to turn off platform-specific newline translation; this will avoid the \n to \r\n translation on Windows and not hurt on other common platforms. It wouldn't surprise me if this was the default for network sockets anyway, though.)
(1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"