Karma + Post Farming on /r/WallStreetBets for Stock Market Profit
As the recent run on GameStop, AMC, and other “meme stocks” have shown, online sub-communities have the capacity to create deep disruptions in financial markets. Through the collective effervescence of the forum, /r/WallStreetBets appeared to organically determine to coordinate purchases of specific stocks. The “purpose” of the purchases varied for users, and varied in its effects, from a simple pump-and-dump scam, to a contemporary Occupy Wall Street digital protest. While this particular instance appeared to be leaderless, bottom-up, grassroot activity, is it possible that some future incarnation of this “meme stock” phenomenon could be fraudulently gamed by small groups of coordinated actors? That is, if /r/WallStreetBets manipulates the market, who manipulates /r/WallStreetBets?
IPM pointed our vulnerability engine at Reddit this week to determine the price of generating accounts on the platform. With these accounts, coordinated, distributed Karma attacks (wherein centrally controlled accounts manipulated the votes, and therefore the prominence, of certain posts) as well as mass-posting of specific stock symbols can be employed to shift the attention of /r/WallStreetBets to stocks already purchased by the attacker, to be sold to the Reddit users when they flock to purchase it.
Far from a fiction, researchers both casual and academic have provided compelling evidence that such large-scale manipulation of Reddit is possible. The principal cost for a bad actor to engage in this behavior is the purchasing and provisioning of accounts. With our vulnerability engine, we are able to generate fine-grained measures on the precise cost and time it takes to generate them.
In short, we estimate that the cost to generate 1,000 accounts is roughly $92 dollars - and each account requires approximately 1 minute to generate. The long time required to generate the account is mostly due to solving CAPTCHAs that are presented when creating accounts. Whereas most people imagine the CAPTCHA to effectively mitigate automated behavior, in truth, services like 2Captcha provide for-profit APIs that automatically solve CAPTCHAs - the long wait period for creating the account is mostly just a hold-up caused by waiting for someone to solve the CAPTCHA and provide the answer to 2Captcha, which then returns the answer to the requestor via API calls.
Paired with pop-up services like The Meme Stock Tracker, which publishes the most commonly-discussed stocks on an ongoing basis, an automated system could determine stocks likely on the “cusp” of some discontinuity jump caused by the Reddit community, purchase that stock automatically, post and promote that stock, and then sell back to the users. As projects like @Trump2Cash have shown previously, automated trading bots built on the basis of online activity can indeed be monetarily valuable. Shortly after we analyzed the case for manipulation on /r/WallStreetBets, news broke of huge increases in bot activity on the subreddit - it doesn’t take much to imagine why that could have occurred.
