Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/23/2018
04:38 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Battling Bots: How to Find Fake Twitter Followers

Duo researchers explain the approach they used to detect automated Twitter profiles and uncover a botnet.

The discovery of a massive botnet can start with finding a few fake Twitter followers, report Duo researchers investigating the process of identifying and analyzing automated accounts.

Earlier this summer, Duo's Olabode Anise, data scientist, and Jordan Wright, principal research and development engineer, wrapped up a project investigating how they could detect Twitter bot characteristics. The goal was to create a means of differentiating automated and legitimate accounts, and they built a classifier tool to distinguish bots based on a pre-defined set of traits.

Their research dug into one of the largest random datasets of public Twitter accounts to date, they report. As part of their project, Wright and Anise identified three specific types of bots serving different purposes. "Content-generating" bots actively create new content (spam, malicious link), "amplification" bots like and retweet content to boost a tweet's popularity, and "fake followers" are a type of amplification bot intended to inflate users' popularity.

The two today published a new report digging into the latter. Their analysis covers how fake followers operate, how they discovered an initial list of fake followers, and how they leveraged that list to unearth a botnet made up of at least 12,000 Twitter accounts.

"We understand the fake followers are just as important to the social ecosystem," says Anise. "They artificially inflate the ratio of followers to followees."

On one hand, fake followers can be used to harass, or compromise the credibility of, legitimate accounts. On the other, they can boost the popularity of fake accounts, making them appear more credible than they are. The researchers gave a talk at Black Hat USA discussing how a botnet spoofed legitimate accounts to evade detection and spread a cryptocurrency scam.

Spot the Bots

It's tough to tell when a follower is fake, and researchers explain more information is better when analyzing accounts. In general, fake followers are hard to detect on an individual level because they don't show much activity – aside from, of course, following other accounts.

But a lack of activity doesn't mean an account is malicious. Some people create Twitter accounts simply to follow other users and stay current on the news, Anise explains.

So instead of hunting fake followers on an individual basis, the researchers decided to consider their full social networks. Fake followers are typically purchased and used as groups; as a result, they tend to share characteristics because they are developed by the same operator.

But which traits set fake followers apart from real ones? After Anise and Wright wrapped their initial pool of research, the botnet they were watching began to use fake followers to trick people into thinking spoofed Twitter accounts were real. They took a closer look at the followers of a fake Elon Musk Twitter profile and explored their similarities.

"One thing that we saw was, [they were] pretty easy to identify," says Anise of the fake followers. "These bots weren't really trying to hide … if you notice patterns or have a similar account, you can use it to pivot and find other bot accounts."

Timing is one key factor. If a large group of accounts suddenly follows the same profile, for example, there's a higher likelihood they're fraudulent.

Accounts following the fake Elon Musk profile had a proverb or fortune in their profile description – a quick and easy means of bypassing spam detection. Profile completion is an easy way to determine the quality of a bot; if an account has a profile, it appears to be real. However, creating unique profiles is harder than generating random usernames.

With this in mind, the researchers could separate these bots from legitimate followers. Because they were studying the fake accounts as a group, they could observe whether similar accounts had similar behaviors. Once they found a small group of fake followers, they could branch outside that network and look for other fake accounts with similar traits.

How to Crawl for Followers

Anise and Wright uncovered the botnet with a "one-degree crawl" of a single fake follower. They found a fake account and looked at their social network, as well as the social network for each account the fake follower was following. They then applied a script to search the social network for a specific account. The result is a web of fake and legitimate profiles, connecting which fake accounts are following legitimate ones.

While it's a good start, not every bot in a botnet will follow the same people, meaning the researchers may not have caught entire groups of fake followers. To find new ones, Anise explains, they can use a bot found during their initial crawl and search its network for new fake followers. After doing this, they uncovered an additional 1,200 bots.

The two point out that large groups of fake followers have patterns that are easier to recognize; smaller groups, in contrast, may be more subtle. To find smaller groups of fake accounts, the researchers first determined when multiple accounts were created on the same day and consecutively followed a target account.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 2
jacksonseo
50%
50%
jacksonseo,
User Rank: Apprentice
5/18/2020 | 3:43:54 AM
jackso seo
Through this post, I realize that your great information in playing with all the pieces was extremely useful. I advise this is the primary spot where I discover issues I've been scanning for. You have a shrewd yet alluring method of composing. 
hibbah
50%
50%
hibbah,
User Rank: Apprentice
9/28/2020 | 5:12:14 AM
creare site web
very interesting keep posting.   
DogCrib
50%
50%
DogCrib,
User Rank: Apprentice
11/27/2020 | 8:35:54 AM
Pending Review
This comment is waiting for review by our moderators.
<<   <   Page 2 / 2
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29378
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...
CVE-2020-29379
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
CVE-2020-29380
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-...
CVE-2020-29381
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in &quot;upload tftp syslog&quot; and &quot;upload tftp configuration&quot; in the CLI via a crafted filename...
CVE-2020-29382
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific to V1600D, V1600G1, and V1600G2) is contained in the firmware images.