Spoofing canvas and webgl

[Sebastiann]

@Sebastiann I also like your obsession for fixing detection, I have the same thing but with 1000x less skills and knowledge . You can imagine how frustrating it is

These are some interesting points as well if you're interested in detection methods: https://cpa.rip/stati/antidetect-palivo

 

[MarkWilson]

These are some interesting points as well if you're interested in detection methods: https://cpa.rip/stati/antidetect-palivo

Love it

 

[MarkWilson]

Guys I think I will move to totally different approach.
I will check both android automation with apps like "automate" or "tasker", and I also want to check "workflow" app for iPhone.
iPhone would surely be the best solution but if not possible android with Firefox browser will be pretty good since the user agent is better than chrome (has less info).

I am taking this path cause I've understood that there isn't any way to do this successfully on pc.
iPhone is an overkill because of the same hardware, useragent..
playwright was fun but let's try real devices!

 

[Sebastiann]

Guys I think I will move to totally different approach.
I will check both android automation with apps like "automate" or "tasker", and I also want to check "workflow" app for iPhone.
iPhone would surely be the best solution but if not possible android with Firefox browser will be pretty good since the user agent is better than chrome (has less info).

I am taking this path cause I've understood that there isn't any way to do this successfully on pc.
iPhone is an overkill because of the same hardware, useragent..
playwright was fun but let's try real devices!

If you root the device, there's some cool off-store automation apps from memory (sorry can't recall the names) that will run lighter and simulate taps more convincingly etc. You'll also want to write some good error reporting tools as well to make sure you're notified when something goes wrong.
The only problem that I can see is scale, ie you'd have to buy a lot of phones! Maybe cheap androids? Either that or a bunch of used old model phones on eBay etc..

Edit: Additionally, you might be able to get puppeteer working on an android device https://github.com/puppeteer/puppeteer/issues/2957#issuecomment-520119482

 

[MarkWilson]

If you root the device, there's some cool off-store automation apps from memory (sorry can't recall the names) that will run lighter and simulate taps more convincingly etc. You'll also want to write some good error reporting tools as well to make sure you're notified when something goes wrong.
The only problem that I can see is scale, ie you'd have to buy a lot of phones! Maybe cheap androids? Either that or a bunch of used old model phones on eBay etc..

Edit: Additionally, you might be able to get puppeteer working on an android device https://github.com/puppeteer/puppeteer/issues/2957#issuecomment-520119482

Researched a bit, I want to focus on this solution: iphone + autotouch
I just love the fact that you can use JavaScript to automate an iPhone. seems a very powerful tool.
if I am not able to make it work (but it will), I will try android + Firefox browser and some other automation for Android.
After a lot of reading, I am fully convinced that an iPhone solution is the most solid one for botting anything. It is just too stealth by default.
Regarding scaling: it is not a problem, think about this: if you have just 10 phones farming accounts 24/24, you will make thousands of accs per day. that's more than enough for me to have a big return in any case.. so budget and scaling will not be a problem. webdriver is not reliable, I believe an ideal botting scenario doesn't rely in any case on a webdriver.
So much time wasted in trying to achieve a perfect emulation and fingerprint.. that is just not possible unfortunately!

 

[Sebastiann]

Researched a bit, I want to focus on this solution: iphone + autotouch
I just love the fact that you can use JavaScript to automate an iPhone. seems a very powerful tool.
if I am not able to make it work (but it will), I will try android + Firefox browser and some other automation for Android.
After a lot of reading, I am fully convinced that an iPhone solution is the most solid one for botting anything. It is just too stealth by default.
Regarding scaling: it is not a problem, think about this: if you have just 10 phones farming accounts 24/24, you will make thousands of accs per day. that's more than enough for me to have a big return in any case.. so budget and scaling will not be a problem. webdriver is not reliable, I believe an ideal botting scenario doesn't rely in any case on a webdriver.
So much time wasted in trying to achieve a perfect emulation and fingerprint.. that is just not possible unfortunately!

The more I think about this idea the more I like it!

ie you don't even need to mess around with proxies because they are using 4g by default..

 

[MarkWilson]

The more I think about this idea the more I like it!

ie you don't even need to mess around with proxies because they are using 4g by default..

That's right. need to change IP? just toggle airplane. No problems of WebRTC IP inconsistency. No canvas/webgl detection. And autotouch gives JavaScript support? what are we even talking about

 

[Sebastiann]

This fingerprinting attack is already patched by Apple, but I would make sure to disallow any access to any sensors etc from the browser in case there are any 0-day methods out there that use the device's sensors in a similar way.

https://www.schneier.com/blog/archives/2019/05/fingerprinting_7.html

 

[Sebastiann]

That's right. need to change IP? just toggle airplane. No problems of WebRTC IP inconsistency. No canvas/webgl detection. And autotouch gives JavaScript support? what are we even talking about

Make sure to read up on if there is an Apple version of Google's SafetyNet Attestation API and how that might affect your strategy with these physical handsets.

Also, look into the iPhone's UDID - it appears quite complicated to change it: https://www.reddit.com/r/pokemongob...tructions_how_to_reset_your_iphone_device_id/

It looks like you can rotate it to a new one, but not sure how you would go about getting an old one back (ie it would be fairly suspicious if your account kept logging in from fresh UDIDs each time...)

Obviously the simplest way around it is to just have a 1:1 device to account ratio if it was a long term strategy (even then if you wanted to run 1,000 accounts, that's $100k in used iPhones) and it seems like your plan is to create many accounts per device which seems obviously problematic with this approach.

Perhaps because you are only planning to create one off accounts, getting a fresh UDID each time might not be a problem?

Will be interested to see if you find any way around that! So make sure to post if you find something!

 

[MarkWilson]

Make sure to read up on if there is an Apple version of Google's SafetyNet Attestation API and how that might affect your strategy with these physical handsets.

Also, look into the iPhone's UDID - it appears quite complicated to change it: https://www.reddit.com/r/pokemongob...tructions_how_to_reset_your_iphone_device_id/

It looks like you can rotate it to a new one, but not sure how you would go about getting an old one back (ie it would be fairly suspicious if your account kept logging in from fresh UDIDs each time...)

Obviously the simplest way around it is to just have a 1:1 device to account ratio if it was a long term strategy (even then if you wanted to run 1,000 accounts, that's $100k in used iPhones) and it seems like your plan is to create many accounts per device which seems obviously problematic with this approach.

Perhaps because you are only planning to create one off accounts, getting a fresh UDID each time might not be a problem?

Will be interested to see if you find any way around that! So make sure to post if you find something!

I am waiting for an iPhone 7 to arrive soon, will start testing. About the UDID: I think this isn't a problem if you use Safari browser for creating accounts instead of official apps (which could have access to completely different fingerprints). I plan to automate just the browser.

Will research about safetynet but I think that it doesn't get involved too if you use only safari (not sure about this).

Account creation only could be managed on iPhone in order to avoid captcha, than everything else will be moved to playwright if possible .
Considering the fact that I cannot emulate a phone on pc properly, I think at this point having the most generic desktop configuration could be just fine.
I am now only deleting webdriver property and some webrtc leak stuff, + passing the --disable-gpu in the browser context. nothing else for detection

 

[Sebastiann]

I am waiting for an iPhone 7 to arrive soon, will start testing. About the UDID: I think this isn't a problem if you use Safari browser for creating accounts instead of official apps (which could have access to completely different fingerprints). I plan to automate just the browser.

Will research about safetynet but I think that it doesn't get involved too if you use only safari (not sure about this).

Account creation only could be managed on iPhone in order to avoid captcha, than everything else will be moved to playwright if possible .
Considering the fact that I cannot emulate a phone on pc properly, I think at this point having the most generic desktop configuration could be just fine.
I am now only deleting webdriver property and some webrtc leak stuff, + passing the --disable-gpu in the browser context. nothing else for detection

Ah yes, I forgot about just doing it via the browser, surely that wouldn't provide access to the device id, unless there is some weird way they are doing some canvas style stuff that somehow extracts it.

Edit: https://www.apple.com/safari/docs/Safari_White_Paper_Nov_2019.pdf
Looks like they are adding a lot of anti-fingerprinting stuff in by default which is good..

 

[Aulig]

Maybe this site can help find some more possibly fingerprinting factors: https://panopticlick.eff.org/

 

[Sebastiann]

Just saw this article: https://blog.nem.ec/2020/05/24/ebay-port-scanning/

Although eBay's script doesn't appear to look for port `:35000` (Multilogin's default automation port), his vector could easily be used to scan for it. So anyone using MLA should change the default port to something random.

 

[MarkWilson]

Just a quick update guys
tested on iPhone for some time now, not worth it.
don't have time right now to go in details, it is just not worth the cost and the lack of scalability and reliability.

My current config in playwright is able to pass distil and often also recaptcha, but still 0 success with Datadome. I can navigate to the site but after 2-3 clicks I get instant blocked, even by making hotspot with my phone (just in case problem was some proxies leak)
Has anyone figured out how to beat these guys?
it's becoming something personal

 

[Sebastiann]

Do you actually need to beat Datadome for any particular reason or is it just academic at this point?

 

[MarkWilson]

Do you actually need to beat Datadome for any particular reason or is it just academic at this point?

well, just for science but if I can beat that I am sure I can beat recaptcha too. so it would be still useful

 

[MarkWilson]

I was finally able to bypass datadome!
distil network blocks me with my custom proxies, seems some TCP fingerprint is going on or it could be caused by the way I am handling webrtc leaks. with WiFi or hotspot everything goes smooth with distil too.

recaptcha now is the final boss it still block me sometimes, if not logged in Google I get fixed 0.3 score. if logged in, 0.9. would like to reach 0.7 without logging in

 

[Crazyfire]

I'm testing datadome as well, they are very sensitive regarding IPs, got verification page on my work PC after running only one puppeteer test in the same network.

 

[Sebastiann]

I'm testing datadome as well, they are very sensitive regarding IPs, got verification page on my work PC after running only one puppeteer test in the same network.

Yes it's pretty interesting how they approach it ie:

https://datadome.co/bot-management-...-how-to-identify-bot-traffic-to-your-website/https://datadome.co/bot-management-protection/one-third-bad-bots-using-residential-ip-addresses/
I've been working on attacking the problem from three angles:

1. Run all puppeteer automation in isolated worlds so their method override techniques can't monitor execution.
2. Really getting deep on the "behavioural" part of the problem, ie capturing third-party traffic and replaying it, as well as randomising everything down to the microseconds between the mouse-up mouse-down of a click.
3. Locking down every piece of hardware in the connectivity chain that I have access to, for example; [ Start > Run > Resource Monitor > Network tab], watch how much your device is leaking requests to Akamai and AWS etc from different services and software you have running. (Same with any mobile devices you have sharing the exposed IP). I have to imagine this is all being sent to a data lake for analysis by these sort of services - it's exactly what I would do if I was running the Blue Team detection strategy. Also, using Quad9 as DNS instead of Google/Cloudflare etc.

 

[Sebastiann]

I was finally able to bypass datadome!

How did you end up verifying out of interest? My only check is just browsing a bunch of pages on their site, but I'd love to find something more reliable like the other testing tools we've talked about.

distil network blocks me with my custom proxies

How many threads do you need to run? Tier-1 geo 4G is by far the gold standard at the moment, I made a post about how we rotate through 4G IPs programmatically for small AOs here:
https://www.blackhatworld.com/seo/m...geo-worldwide-remotely.1246740/#post-13391824
But ultimately if you need to run any reasonable number of threads (ie more than 5), just invest in a 4G gateway, it will pay for itself very quickly compared to renting proxies.

recaptcha now is the final boss it still block me sometimes, if not logged in Google I get fixed 0.3 score. if logged in, 0.9. would like to reach 0.7 without logging in

Why not just have each Identity logged in if it has that much of a performance boost?
Even then you may still get them but with 2captcha it costs like 0.00000001c to solve them on the run, so I wouldn't worry too much.
And what do you get as a score logged out on a clean user account on your main PC?