Cloud

11/6/2017
04:13 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cognitive Mindhacks: How Attackers Spread Disinformation Campaigns

Researchers investigate the tools and techniques behind cyber propaganda and fake news and how it changes public opinion.

Disinformation campaigns, otherwise known as cyber propaganda, cognitive hacking, information warfare, and the more common "fake news," have roots in history but are increasingly relevant, and dangerous, as actors manipulate Web tools to sway public opinion.

Content promotion services have been in the "gray market" for a while, but fake news didn't start to gain widespread attention until the 2016 US Presidential election, explains Vladimir Kropotov, senior researcher for Trend Micro's Forward-Looking Threat Research (FTR).

In a few weeks, Kropotov will join fellow FTR senior researchers Fyodor Yarochkin and Lion Gu to present tools and techniques used among cyber propaganda perpetrators around the world in a Black Hat Europe presentation titled "Enraptured Minds: Strategic Gaming of Cognitive Mindhacks."

"Information distributes too fast, and people can make wrong decisions based on information from unreliable sources," Kropotov explains.

Researchers believe the success of fake news campaigns relies on three distinct components: social networks, motivation, and tools and services. The absence of one of these factors will make the spread of disinformation more difficult, if not impossible, they say.

The Dark Web is full of tools to spread fake news campaigns. Some of these can be used for legitimate purposes, such as content marketing, but their power can also be leveraged to disseminate propaganda and influence public opinion. A few are available on the gray and legitimate markets, but these don't have the anonymity of the underground.

Today, most fake news campaigns are considered to be politically motivated. However, researchers say, other motives exist and the same tools can be used to achieve them.

"I think people in big companies and enterprises should be aware of the availability of services like this," says Yarochkin. For example, he explains, these services can be used to promote content intended to make particular companies hot on the stock market. PR agencies can use the same tools as threat actors to spread information in the wake of a crisis.

"It's not purely underground services," says Kropotov of the tools used to spread fake news. "The same technologies have been used widely by media agencies and in advertising."

The researchers learned that Chinese, Russian, Middle Eastern, and English-based underground marketplaces all offer services for anyone who wants to launch disinformation campaigns.

"One of our ideas was to watch how [fake news] looks to the United States, and Russia, and Arabic-speaking countries," explains Yarochkin. Tools used to spread fake news vary from place to place, and each reflects the social and online culture of its respective region.

Example: The Chinese marketplace

As an example of geography-specific tools, consider the Chinese underground, which researchers also analyzed. Given the difficulty of accessing certain social media platforms outside China, most of these tools are unsurprisingly limited to the Chinese market.

One such service, called Xiezuobang, charges money to create and distribute content. Pricing varies depending on the platform where the article will be published. While it could be used for content marketing, the service could easily be abused to spread propaganda, researchers say.

Several Chinese websites advertise a "public opinion monitoring system" that can allegedly survey and influence opinions in popular social media networks and forums, depending on the customer's specific area of interest. One of these, the Boryou Public Opinion Influencing System, says it can monitor 3,000 websites and forums, and add automatic posts and replies at a reported rate of 100 posts per minute.

"An administrator could gather feedback from websites and forums, if they want to know what people are saying and thinking," says Gu.

On the Chinese underground, researchers also found services leveraging social media to sway public opinion. Brokers offer paid posts and reposts to distribute content on Chinese social media networks. Clients pay to have their content posted by influential users; the more popular the user, the more expensive it is to have that user repost your content.

"Buyers will bank on a celebrity's visibility as a potent means to deliver their desired content to an expansive pool of audience," researchers say. A famous Weibo user with 78.25 million followers, for example, costs $180,000 for their visibility.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
rwaltzman
50%
50%
rwaltzman,
User Rank: Apprentice
11/6/2017 | 9:26:38 PM
Who is Minding the Store?
As far as I can tell, this is the only session at Black Hat related to this subject.  That is scandalous.  There are a lot of folks out there wearing very black hats indeed that those attending this conference don't seem to be paying much attention to.  That really needs to change.
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.