I Hacked HQ Trivia But Here’s How They Can Stop Me
By: Stephen Cognetta
Tags: Tech, Hq, Apps, I Hacked Hq Trivia, Live Streaming

HQ Trivia, one of the hottest apps of 2017, is reinventing what game shows look like in the 21st century. On HQ, you can tune in live every day to answer trivia questions for the chance to win thousands of dollars.

However, as HQ Trivia increases in popularity, it exposes itself to a significant risk. Hackers, hoping to make some extra cash, can programmatically Google the answers to the questions. If these hackers and their scripts are successful, it could ruin the fun of HQ for honest players.

To explore the feasibility of hacking HQ, I wrote a script that wins the majority of HQ games. In this post, I explain how the script works, and how HQ can defend itself against these attacks. The script generally follows these three steps:

Mirror phone screen to computer screen. Translate the image of the phone screen to computer-readable text. Using Google, run three separate approaches for finding the answer.

Please note: other than some general testing, all of the methods described in this blog are used on YouTube videos of the live HQ game, but not on the game itself. It is against the terms and conditions of HQ to use scripts on the live game.

Extracting The Text

First, the script needs to extract text from the app in order to process it.

I mirrored my phone screen to my laptop using QuickTime’s built-in screen mirroring feature and an Apple Lightning Cable, which ends up looking like this:

After mirroring the screen, I programmed a Python script to automatically screenshot the screen at specified coordinates, using the “screencapture” shell command. Then, the script uses the Tesseract OCR library to perform OCR (Optical Character Recognition), which converts the image to computer-readable text.

Now that the script has the parsed text for both the question and the answer choices, I then found three different approaches that all work with about 50–80% accuracy each. My final script runs all three approaches, so that I can review the total results for a final decision.

Approach 1: Googling the Question

The most intuitive approach is just to Google the question. This was an easy one-liner in Python:

About 50% of the time, this approach shows a Google search results page with the answer on it. However, it’s often hard to parse all this text myself, and it reliably fails on any questions that are “Which of these…” questions, since those questions rely on not just the question, but also the answer choices. For example, Approach 1 completely fails on this question:

Approach 2: Counting Answers on Results Page

Now, what if we could automatically scan the page for the answer choices? This would be much faster than what a human could do. Additionally, Google exposes a Custom Search API, which allows the script to access Google’s search functionality without even opening a browser.

For this approach, the script uses the Google Custom Search API to Google the question, and then counts the number of each answer choice that appears in the response (this includes not only the link titles, but also the little snippet that appears below the title).

While Approach 2 is correct more often than Approach 1, it can sometimes underperform. Approach 1 is superior than Approach 2 especially when it comes to “misconception” questions. Take a look at the following: