Great question... Most claim they "find them"...but they aren't hard to get..
I had one kid who was buying them online. The automated message was "are you 18 or older?" He would just click yes and that was it. He had quite the business running for a while.