Hackers caught cheating in virtual stock market game

AUSTIN, Texas--When I wrote a story a couple days ago about trying to game the virtual Startup Bus stock market game, I didn't realize that I was playing in the minor leagues.

The major leagues, it turns out, was an organized hack that illegitimately benefited three of the teams that were leading the stock competition among each of the several dozen teams of "buspreneurs" aboard the six coaches that made their way from cities around the U.S. to Austin for the South by Southwest conference.

As part of the Startup Bus project, each of the teams on board one of the six buses created a new product or application from scratch, with the intention of having it presentable by the time they reached the Texas capital. Each team's business has shares that have been trading in the virtual stock market, and though the share prices didn't have a lot to do with what players--largely folks unconnected with the Startup Bus--thought of the products, there was at least a sense that shares would go up based on legitimate demand for them.

But the shares of three of the teams at the top of the game's leader board for most of the competition were seemingly benefiting from an effort by a member of Hacker Dojo, the Mountain View, Calif., hacker community center to get other members to run an automatic script that would open player accounts in the stock game and buy shares in the three companies.

A transcript of an e-mail thread titled "Ballot stuffers needed" obtained by CNET revealed that Hacker Dojo member Dean Mao, responding to a call-out to the Hacker Dojo for legitimate support of one of the teams on board the Startup Bus, created a script that would open new accounts and bet virtual dollars on that team and what seems to have been two others.

"What would the Dojo be without a real ballot stuffer?" Mao wrote to the Hacker Dojo e-mail list. He then followed up with instructions on how to use a tool called phantomjs to run the script and create the fake accounts.

The result was apparently thousands of virtual dollars being invested in the three companies' shares, and those three stocks' subsequent jump to the top of the charts.

Of course, this being an entirely virtual stock market game with no tangible reward for winning, the hacking had no real consequence.

Indeed, contacted about the hacking effort, Startup Bus founder Elias Bizannes seemed amused.

"Ha, when hackers try to do that, I suppose that's a good thing," Bizannes told CNET. The "good news is that this exploit is no longer a problem and the fake accounts will be penalized. We've identified 1,300 fake accounts, with 900 from the same IP address, so not exactly done smartly by them. It's a problem not with technology, but identity--which to be honest, is just a problem across the Internet."

Anyone could sign up for an account in the game using a normal Web site registration system--a user name and a password. But Bizannes said that after the exploit was discovered, the rules were changed to require that players sign up using an existing Facebook account. And that means, Bizannes said, "you need to game Facebook as well in order to game the [stock market] game."

Contacted by CNET for comment about the hacking effort, Mao said he was happy a story was being written about it and explained his rationale.

"I don't believe there was any goal for the exercise--other than a reason for me to learn more about a tool called phantomjs," Mao said. "I was hoping to eventually replace our complicated selenium scripts with something more lightweight and it seemed like phantomjs fit the bill, but I haven't used it much until now. We support our fellow Hacker Dojo members on the Startup Bus, many who work at very small startups themselves. I think when I wrote this tool, I didn't think so many of our members would try it out and it definitely got out of hand! However, success on a game rarely translates to startup success. Startup success is rarely 'gamed' and requires the right timing, a little luck, and lots of determination even when the company is on the brink of failure. I think the media too often portrays overnight startup success stories, when in reality, most of the successful [projects] come from years of failure and hard work."

All of which means, of course, that when I tried to use a little semi-inside information to boost my own fortunes in the game, I had no idea who I was up against. And that's reflected in my own poor performance. Next time, I'll ask for some professional help.