How is G00gle tracking me? Using Selenium to create accounts.

I'm using C#, Selenium and Firefox to quicken up the registering of Gma1L accounts, but G00gle is blocking the accounts I'm making now, and I'm looking for help as to why

Host machine: Ubuntu Desktop
VirtualBox VM: Windows 7 Pro SP1

Each time I fire up the VM to create a account I change/do the following:

New Mac address
New IP (Residential DSL/National Company)
No Flash installed
No Java installed
Cookies cleaned (inc. LSOs)
Screen resolution changed
Cache cleaned

The stand-out thing to me is the fact that yes I'm doing this using a virtual machine, but I'm working on a strict budget, and want to make account creation is quick as possible, on the cheap.

The first time it blocked me I had changed the Mac for the very first time, which I thought would help after looking through the TCP/IP stack. I had created 4 accounts in the previous 48 hours no problem with the same MAC.

I had registered as normal, got the PVA pin sent to a new sim card/number (same phone/IMEI), entered the pin and BAM, account disabled.

So I tried again, same telephone number but I started changed the user-agent.

The browser and OS language was still English UK, where I'm at/IP location. Account disabled again.

I mean, all Selenium is doing is populating the registration form, and not even all of it, just the text boxes, so part of the form filling is still done manually.

Anyone have any info or ideas they could share?

Thanks a lot.

Could be DNS or WebRTC leak, have you checked that?

There are a few different footprints that Google loves to look at and I know of 2 of them off the top of my head.

1) Typing speed (when/how fast you're typing into said textbox's)
2) Firefox BuildID Because selenium is a plugin/custom build of Firefox then a lot of the features of a normal version of Firefox are different/weird/messed up.

One way to check your buildID in Firefox is by visiting http://browserspy.dk/showprop.php and scrolling down till you see something like this: 20151014143721
This can be changed, I don't know how exactly, I know if you were using something like ZennoPoster you could "spoof"/"Change" it but I don't think you can with Selenium.

If you want to PM me I could share with you some more detailed information on Google's new recaptcha (it's old code but it shows a ton of detail about how google tracks users/browsers) as shared by another random internet user. Its some python code that I really wish I knew how to decode properly and play with.

]

Des_cartes said:

Could be DNS or WebRTC leak, have you checked that?

Click to expand...

DNS is OpenDNS, not heard of WebRTC but will look into it.

ZennoScripts said:

There are a few different footprints that Google loves to look at and I know of 2 of them off the top of my head.

1) Typing speed (when/how fast you're typing into said textbox's)
2) Firefox BuildID Because selenium is a plugin/custom build of Firefox then a lot of the features of a normal version of Firefox are different/weird/messed up.

One way to check your buildID in Firefox is by visiting this page and scrolling down till you see something like this: 20151014143721
This can be changed, I don't know how exactly, I know if you were using something like ZennoPoster you could "spoof"/"Change" it but I don't think you can with Selenium.

Click to expand...

Thank you on the Selenium using a particular BuildID, this would be a huge red flag I bet. If Selenium can't change it it is open source so must be possible to do.

And typing speed yes, I thought maybe the same, the accuracy of the clicks and stuff.

I have just set it to first search G for gma1L, click the search result and follow a more natural registration process, but I will have to implement a natural browser BuildID as per your advice.

Nice one.

seeplusplus said:

]

DNS is OpenDNS, not heard of WebRTC but will look into it.

Click to expand...

hah, check this out http://www.blackhatworld.com/blackh...g-your-real-ip-websites-popular-browsers.html

You will be SHOCKED.


Also Canvas might be the problem. Discussed here http://www.blackhatworld.com/blackh...nt-standalone-extension-part-vpn-service.html

Oh yeah using a proxy without disabling webrtc on modern browser is completly usless all companies are using it now to get users real ip.

I was doing this last year and had the same problem.

The problem is because you type in an automatic way. Even populating a single input and typing the rest by hand, you will get troubles so you need to make that part more "human".

I can't say how I solved my problem but it is possible.

Des_cartes said:

Oh yeah using a proxy without disabling webrtc on modern browser is completly usless all companies are using it now to get users real ip.

Click to expand...

You serious? Is it difficult to disable webrtc on my browser? I use chrome, which by itself is even bad, especially for our industry. Yet i cant stop using it.

Bahmer said:

You serious? Is it difficult to disable webrtc on my browser? I use chrome, which by itself is even bad, especially for our industry. Yet i cant stop using it.

Click to expand...

Yes I'm serious and I know for fact that companies use it to fight against VPN and proxies since not a lot of people know about it, last time I checked you can't disable it on Chrome (I think some plugins can still help you tho) for Firefox you can use any of the many plugins or disable it manually in the about:config page.
Just google "WebRTC" or "WebRTC ip leak", you'll fin hundreds of articles about that.

Damn crazy. So much for firefox being "secure" and stuff.

Peachpies said:

Damn crazy. So much for firefox being "secure" and stuff.

Click to expand...

Nothing is ever secure, just as safe as they can make it.

I have not heard of the webrtc leak before. I was thinking maybe the favicon had an etag on it.

ZennoScripts said:

There are a few different footprints that Google loves to look at and I know of 2 of them off the top of my head.

1) Typing speed (when/how fast you're typing into said textbox's)
2) Firefox BuildID Because selenium is a plugin/custom build of Firefox then a lot of the features of a normal version of Firefox are different/weird/messed up.

One way to check your buildID in Firefox is by visiting and scrolling down till you see something like this: 20151014143721
This can be changed, I don't know how exactly, I know if you were using something like ZennoPoster you could "spoof"/"Change" it but I don't think you can with Selenium.

If you want to PM me I could share with you some more detailed information on Google's new recaptcha (it's old code but it shows a ton of detail about how google tracks users/browsers) as shared by another random internet user. Its some python code that I really wish I knew how to decode properly and play with.

Click to expand...

OMG, 'Typing speed' I didn't think about it. Thanks for this!

I know python and selenium, I could help demystify for you/us

Yup, I have 3 kids and a lawsuit, lol
don't trust condoms either

Don't know what happened to the quotes for the above. Sorry

Ya, typing speed is a huge one and your mouse movements are tracked. Even if it is not moving. If it is in the same all the time it will be suspicious looking.
rate between fields too
browser size
plugins used
OS used

shoot, soon we'll need finger prints ha!

CD

No idea how to do it in selenium but UBOT has options for typing speed and mouse emulation too. Must be ways to do similar with selenium, or if not maybe with Casper or phantom?

Browser fingerprinting in general is a pretty deep issue, basically reading that every browser is virtually unique so if you are not creating "virtually" unique browser instances chances are tracking can be done

https://amiunique.org
https://panopticlick.eff.org

HTTPS://myip.ms/browse/comp_browseragents/

obviously those links are more about headers and user agents not so much about the webrtc leaks mentioned already, but hopefully it might help you out with uniquification

Does the time zone on your machine match the time zone of the IP?

Why even create Gmail accounts? Do you just need them for churn and burn to sign up accounts on social media etc? If you want churn and burn email account that you can setup INSTANTLY just use 10 minute mail. I do it all the time. 10 min mail is gold.

Google uses Flash and Adobe AIR cache too from what i heared. Cleared/removed them too?