Hacker News Reader

Comment by petemill | Hacker News Reader

Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic:

> Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device allows us to connect to Facebook advertising APIs from your home network and avoids the hassle of your account being locked due to unfamiliar activity. Learn more about the Raspberry Pi below.

[0] https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...

View on HN

I find these claims extremely dubious. Everything they claim the Pi is needed for can be accomplished without the equipment and postage costs with a purely software solution; The hardware allows them to monitor all traffic and avoid antivirus/firewalls. Moreover, I doubt it is difficult to find mass-market Facebook accounts for much less than $15/month - it is far more likely that, given the hardware allows them unfettered access to all network traffic, it is designed to report back as much data as possible, ideally including plaintext passwords and banking information.

In this case, having a distributed botnet of Pis at people's houses would make sure you didn't get IP blocked by Facebook, since there are also legitimate users at that IP. Facebook probably would not block it, and even if it did unplugging and plugging back in the modem is enough for most residential gateways to get a new external IP.

The hardware gives a better guarantee of botnet uptime though. If you want it to be powered on and attached to that network 24/7, you can't rely on their laptop/desktop.

>Why do you need my account? Why not use your own? We have plenty of our own accounts. We need you because no matter how many accounts we have internally, Facebook limits the amount we can spend per account. By working with people like you, we are able to scale our business.

Can somebody explain if this makes sense? Why are there limits on account spending?

Because the ad spends are fraudulent in nature? Just a guess.

No, but if you accept the answer, you get $15.

probably using stolen CC's to buy ads

Look lower down that thread for the FAQ from the company: they're using the roommate's Facebook account to purchase targeted ads on Facebook in order to evade Facebook's internal controls. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...

The first comment in the thread you link to says the Raspberry Pi connects to botnets and records all network traffic.

> It records EVERY KEYSTROKE sent of the network, even SSL connection.

One wonders how it does that.

A microphone and some basic ML?

Sort of tongue in cheek, since I don't know the range of state of the art acoustic side-channel taps. I guess you'd also probably have power fluctuations and network timing channels to exploit.

Plus, a lot of different points at which to attempt to insert a second stage into the connected devices themselves, using all the tricks everyone else in this thread has mentioned.

I think that just means it records everything sent over the network.

Reply on news.ycombinator.com