welcome to our talk benator hunting and
smashing trolls on twitter
by santiago perez montagno and mauro
eldridge from dc5411
before we start we'll make a short
introduction about ourselves
and about the main topics of this talk
my name is mauro eldridge i'm an
argentine hacker and the founder of bca
and dc5411 which is the defcon group for
argentina and uruguay
i spoke at defcon a couple of times
before different villages
and i spoke also at other conferences
around the world
including many places now my
co-speaker santiago is going to
introduce himself
okay i am santiago perez
montagno i am a security engineer at the
bca
i am a member of the defcon 5411
group argentina uruguay i have the
opportunity to give talks
in different parts of the world such as
the greyhound in the united states
at the postcon in iran and a
digital self-defense or autodefensive
item
in argentina today i have the pleasure
of being
in one of my favorite conference and in
one
of the most important hacking villas
i hope our talk is to your liking
so this talk is about trolls how their
tactics work
how to identify them based on different
behaviors
and patterns they show and how they
turned
social media into propaganda machines
we will explain a real case of a
propaganda paratu sing from the inside
this is something that we have been
working on
during the previous defcon during the
previous year and we
even published it on this same village
in the recon village last year
using a subpuppet account we will be
able to profile
and analyze different members of this
propaganda paratus
and show its results here we will also
try to profile
ongoing campaigns that just happened
some days ago
we will show different tools not only to
analyze but to combat
these trolls and among those tools there
will be
venator our tool
just uh a little disclaimer all the
information that
you will see here was obtained via
legit means via ocean
and all the accounts which are going to
be displayed during this investigation
are anonymized so no real uh usernames
will be displayed even if those belongs
to a troll account to a faye account
or whatever and obviously we were not
involved in
anything illegal so
now my partner santiago is going to give
you a brief introduction
on the core concepts that we will use on
this talk and
then we will be able to further advance
and to
see this propaganda paradox from the
inside and start analyzing it
so santiago please go ahead
introduction first of all let's talk
about
what propaganda is it is known
as the set of means methods and
techniques by means
of which a message is made noun
disseminated or disseminated with the
aim
of attracting followers or followers
for its cause or influencing people's
behavior as such propaganda has been
used for primarily political religious
social or even military purposes
throughout history it is an important
weapon
of ideological struggles that uses
all the media that we are within its
reach
from the traditionally to the
non-traditional
it differs markedly from advertising
and tries to push an agenda
in this talk we will tell you how we use
it
daily in politics what do drugs
do and what are they
the objective of the troll on the
internet is to
show discord create confrontation and in
general i know it by diverting
the conversation from other users and
attracting
attention to him how do you do that
leaving comment where you want to create
conflict
it can be in social network web page
or blogs that download allow comments
forum etc any online site where they can
make a comment or whatever chat live
as in an online game is a trolls
playground
all you have to do is make a comment
provocative
enough that another user responds in a
similar tone
and follows the conversation on that
line
in the end the issue is distorted
and the troll has achieved his goal
which is to have been the center of
attention and cause it
an argument trolling can be more
directed towards an entity such as
company
or company or a brand or towards a
specific
person in this particular case we are
going to show you
how the trolls act in favor of the
political apparatus
that is closely linked to a particular
political party
or idolatry and the trolls
can live in spain comets phantoms
are only any other material that would
alter rapidly could turn the tree
into something unbearable to follow for
legend commentators
okay how to detect them or how to spot
them it's simply you just have to use
benator now like it's just a joke
or maybe not the first thing we should
look at
an account is its profile picture if
it's incredible
yes it's really is that the person who
claims to be
then the numbers and the end of the its
user
yet yes it is not exactly
long and substantial
if what you post has cover coherence
or simple publishes phrases or political
attack
if you participate in discussions where
controversial
or trending hashtags are used
behavior is fetal a decide in the
presentation
this type of stroke never work alone
so i'm rehanging they never come along
because
he he works at groups
what is a propaganda
is a system in detail created for a
political
social etc what seeks
to try to convince a sector
that the new is true or simple
to try to persuade that something
is wrong and a simple missing form
throughout the use of social networks
or another type of communication channel
in this case we have come to talk to you
about the program propaganda devices of
social networks
particularly in the social network
twitter
as is publicly known this is network
excluded with trolls and boots
to fulfill different purposes or
missions
that are are a signal to it
that are single treated at a certain
time to try
to make a train in a particular country
um depending on the country how long
it takes to become a trend
these devices are made up of real
people trolls and bots the best known
cases are the glove set in russia the
5th decent party
in china the united front department in
north korea
the bolivarian army of trolls in
venezuela
under cyberka in argentina
the apparatus propaganda apparatus is
quick and massive interaction leading to
fabricated trends
and depending of the country
how long it takes to become a truck why
are
social network use because
it is easier to visualize
you can write a message from any device
which has the internet
the ability to lead a propaganda machine
from within arms reach without even
taking five minutes it's simply
one of the greatest advantages that this
type of people
who are dedicated to this runway
you can easily automate and delegate all
kind
of functions within the trending topics
it is not expensive to maintain or
create
but the only cost it has will be that of
the
international service to access
an account and give orders or simply
execute them to meet your daily
object the big question do
social networks authorize these types of
accounts and behaviors
follow me and i will tell you in more
detail
on the next slide in this slide we can
see which
are the countries that suffer the
greatest attack
from the propaganda apparatus which have
chosen to block ips there be
causing the trolls to be censored in
some way
thus avoiding to a large extent degraded
dimension
of attack of this nature
these countries include russia china
iran north korea syria and pakistan
it doesn't mean that other countries
do not do it as well but
that these are the countries that use it
most frequently here we can see how
the peroneus party created a social
network
to try to fight against impelling and
establishment
but in reality it is an organizing
network
of attack with votes and troll
that focuses on social network such as
twitter to launch its attacks
heavily mission
but the most surprising of all is that
they coordinate
from this type of social network to make
more effective and massive attack
thus pretending to fulfill its objective
and task worst of all
this type of propaganda apparatus is
endorsed by argentina's
minister of culture
where only its military participates
summarizing all these we can see what a
propaganda
apparatus was which are trolls and bots
where they come from and what they are
using for
i hope you dropped your own conclusion
to continue with the talk
and to be able to understand even better
this next stage of it so your country
has a propane apparatus
yes okay let's take a look inside
so trucking trolls in this new chapter
we are going to
analyze at last a real case of a
propaganda paratus
so a real case here is the cyber k or k
troop group this is an investigation
that started last year
and we luckily we were able to present
it here at the recombilash
last year so we don't want to repeat
content from that previous talk so in
the next slides in the next few slides
we are going to
summarize a whole year of investigation
so try to work with us because we are
going to be a little bit uh fast-paced
here
but the idea is to give you a context on
how we got here what are we doing
actually here
on this exact spot so
that context is needed in case you want
to
see every detail every single
communication we had with this apparatus
every single
thing we did you can refer to our
previous talk
from the previous year it will be linked
on the github repository for this talk
so you will be able to fetch all the
information you need from there
this propaganda apparatus is argentinian
so obviously all its communications are
in spanish
as a native spanish speaker i have
translated all the communications in
english so
you don't have to worry about that part
and aside from being
a propaganda paratus based on the
spanish language it has
another thing that makes it that makes
it very particular
which is that this propaganda apparatus
is
composed of uh real users real people
bots there are mostly twitter bots
dedicated to
retweet and to spread to broadcast
certain accounts and trolls
these are fake accounts puppets and so
on
this propaganda apparatus is used to
publicly retweet
its leaders and to promote different
hashtags that they have
some legit users on twitter reported
that
they have received invitations to join
these apparatus
so that rang up all on our heads and we
say okay
how can we get that invitation for
ourselves
how can we be invited there
so we decided to create a puppet account
to get an invitation to get this
invitation
the sock puppet was created by hand
we had we we have only used
social engineering so far we haven't
used any tool
we based our sock puppet on pure
observation
we just started looking at their
hashtags at the most promoted hashtags
on the politics side of things so we
created a fake
profile imitating the accounts that
started broadcasting those hashtags
so we decided basically to be able to
to subtly merge between those accounts
so we try to imitate them to mimic them
as much as possible
we used a really particular
configuration for this account
for example for the profile photo
we chosen a really popular picture of
president fernandez and vice president
fernandez together
most accounts on these propaganda
paratus
featured that very same picture so we
say why not
about the cover photo while most of the
accounts
involved in these hashtags did have not
no no cover photo
we decided to pick one for ourselves but
most of these accounts didn't feature
one
so we chosen one of vice president
fernandez
from a couple of years ago when she was
a president
giving a speech at the belles stadium
we started following the president
obviously and some minister
and a few pro-government accounts that
were run by real people
some of them or most of them were
journalists or different
political analysts from different
tv programs or talk shows
and on the description field on
our own tweets we started imitating
their a specific language and symbolism
that they were using we are not uh
specialists on linguistics or anything
we only used the tutor api to monitor
all the tweets or the hashtags and
extract the most repeated words
forming a word cloud which you can see
here most of these words in spanish
are pejorative terms to refer to
the opposition or to certain
opposition leaders
so during the first hours
of this sub puppet account
we raised around a hundred followers
in just a couple hours
we were only tweeting about
their hashtags and using as much as
possible
the very same words so
in order to generate some
how to say in order to generate
serotonin affinity
after three days somebody
sent me a dm and that was our invitation
and i have it here as i said before
all the accounts those that represent
real people
or not will be anonymizer no matter what
this person says hey buddy we are making
twitter groups to install hashtags
do you want to join and i'm going like
okay hey buddy sure what i'm supposed to
do
basically you have to tweet the hashtags
that we sent to the group
and that's more or less that's it
i was added to the group number 300 and
something of soldiers of the national
project
this group contained 50 people this is
an important detail
on that group people started talking
about different things
but mostly there were briefings
about a specific situation and a hashtag
to broadcast regarding that specific
situation
for example this person say hears hey
guys ariel garvers is asking us to use
laretta is responsible so
as you can see on the picture on the
left there is a briefing
on this picture on green with spanish
text
it says a small briefing um
finally it proposes a hashtag to be
broadcasted
to install this trend this uh this is a
trending topic
narita in this case is the mayor of
buenos aires city and it's a member of
the opposition
ariel garvas as we discussed in our
previous talk
is the leader of the propaganda
apparatus they don't hesitate on
addressing him by his real name
as you can see here and this is from a
neutral source
getdatetrends.com
there were two hashtags proposed in that
group the number two and number four
both of these hashtags are fabricated
trends proposed on these groups
as you can see in the picture in the
previous picture
and they made it to the top five trends
in my country
now taking a look at another third-party
source by trending alia
we can see that both these trends lasted
for at least
12 hours straight this allows us to say
and to state that these interventions
are highly toxic
they remain for almost half a day
now another person goes like this i will
translate
once again with ariel karvaars
remember the leader of this propaganda
paradise
we formed a group where he's the
administrator
and tells us what to publish and at what
time so we can get our trend to
always be on first place once again you
see that
they already assume
what the consequences is going to to be
so they are already sure that they will
install
this as a trending topic
and another one goes like okay yeah it's
like you say we used to do the same long
ago with the k dude
the k youth it's the prototype of what
is now the
k troop or the cyber case it's
it's part of the same group of people
and they say okay you have to sit a day
and a time
and it's the best so
they are really used to do this thing
it's not something they are
newbies at once again certain slogans to
be spread
as you can see in the blue picture and
the
purple one
and then whatsapp chat it's shared
obviously we entered to see how it's
going to be like
but before jumping into the whatsapp
part
this is a screenshot from one of our
twitter accounts
take a look at this
we have according to our latest group we
found we have found
350 propaganda groups on twitter alone
as you can see in this picture on the
left we were invited
twice to different groups so they
do not have a real tight control on
who's on
on who belongs to each group
each one of these groups holds 50 users
49
plus one admin and
we can say that the total number of
users in those groups
is a little bit more than 17 000
that's quite a lot of users
and now jumping into the whatsapp site
as you can see
what the person sending the hashtag here
saying okay at half past seven
we are going to to use this next hashtag
dollar withre the person sending this
message with the phone ending in eight
five five four it's a real garbarce
itself
as we can see in this group name all
groups are numbered
this is the seventh group so there are
at least
six more each one of these groups is
already full
and it has at that time 255 users
without taking their administrator into
account
so if we multiply these users we have
almost 2000 new users
and if we wrap up all the users into a
single
operation we have almost 20 000
users but note that some users may be
present
as it is our case in different groups at
the same time
so there are maybe repeated users this
is an
estimated like number so we can say for
sure
now you might say okay uh 20 000 users
now that's a lot to
fight back yeah it's not easy but there
are some tools
not provided by twitter sadly but
provided by third parties
that will allow you to block massively
certain accounts or
for example an account and all its
followers
or all people that have interacted with
a certain tweet
for example liking it and so on we have
these
three alternatives that are pretty good
actually
sadly a blog together is running i don't
know if it's
running out of business or
simple the project is going to be
abandoned i'm not pretty sure
something that it's happening just uh
as we speak i think um
mega blok for example that says okay
we'll let you nuke a tweet it would
allow you to
block not only a person
giving or writing a specific tweet
but all the people that interacted with
it
also twitter blockchain which is a
third-party chrome extension
works on a similar way but
again there's nothing natively provided
by twitter aside from the silence or
blocking functions
and they are used one by one so you
can block or silence one account at a
time
so unless you're pretty good with the
api
and you know what your way around and
you know exactly what you're doing
yeah it's going to be a little bit
complicated
so back to analysis remember that we
have this account
which was invited and with this
invitation we're going to two
main things first we're going to need
access to the group
chats which means that we have early
access to
the threads they are trying to install
and on the second hand we have access to
higher ranking profiles
that otherwise we won't we won't be able
to
see why because these
higher ranking profiles in these groups
are not involved in tweeting are not
involved in broadcasting these hashtags
in spreading this misinformation they
are involved
only in coordinating the actions so you
will never see them tweeting about
something
they will propose the hashtag but never
say it aloud
so having discovered this i think that
it's time to fit all this data into
benator
at last binator hunting and smashing
trolls as we promised
it binator is our open source
tool to triage different
accounts on social media
and when we started this investigation
on last year the original venator was a
lua script
which was really rigid really hard to
maintain
um it was a tool for which any
change that we needed must be
done multiple times in the source code
we didn't have
anything quite uh tidy quite organized
because we thought that binator will be
something disposable
something that we were going to use once
or twice or that will be bundled inside
something
something else maybe a framework or
maybe another tool
but in the end the reality is that
we we found ourselves using binator on a
daily basis
so we agreed that we had to rework all
of this application from scratch
so this cli tool that you see here
became
binator rv which is written in ruby
and this newest release features web
interface
and api access and
since this one uses a database backend
we are able to keep
track over the time for changes on
different reputation triashes that we
are carrying on different accounts
and also it helps us to make formulas
more elastic
we are going to use this tool binator to
profile one of the cyber case campaign
that is actually
ongoing as we speak as we are recording
to stock
this campaign just happened a couple of
hours ago
so this is pretty fresh pretty hot too
so
our idea is to keep um to keep an
eye on the most recent
campaigns that we can share with you so
this happened on august 2nd and 1st it's
pretty much this week
we are going to follow three hashtags we
are i'm not going to take the time
to explain in each one of them because
there are
there's a long story of
political uh rivalry here so it's pretty
hard to explain
these are one-sided hashtags
this uh these are going from
the official propaganda paratus against
the opposition
and are the following iglesias
misogynist
which is illesias is a parliament member
the fugitive and the stranded which are
references to two politicians
and pro-smugglers pro it's
an old political party from the
opposition and they are calling them
smugglers basically
so we have selected 70 accounts which
are the first 70 ones to engage with
all the proposed hashtags or at least
one of the proposed hashtags given
that no other account
is there to fill this number to fill the
70 ranks that we need
so before starting feeding this
information
let's try to do some awesome some open
source integrations over those hashtags
how it started let's go with iglesias
misogynist
it's number three and look
at the graph on the graphic you can see
that it's making a plane
it just rises skyrocketed and then
it maintained a certain number of
interactions over the time
[Music]
here you can see it with more detail it
started skyrocketed
and started trying to and struggle a
little bit
after a couple hours to still remain
between the most ranked
trends
now how is it going look at this trend
don't you see something strange trends
do not normally skyrocket 10
fall down abruptly something is amiss
here
this indicates clearly that there was a
coordinated action
because it skyrocketed at first it
struggled to be maintained among
the most high the highest ranks of the
trending topics
and also it reached the num the place
number one as you can see here
and after a couple of hours it just
fell it just absolutely felt abruptly
so this is a good indicator that
somebody say okay
start with this and that also somebody
say okay
cut it out finish finish with this we
are done with this
and it lasted for a good couple of hours
now what about the other trends
they were just bite and switch they just
started
and automatically fell
look about the other this is the pro
smugglers one
look at the fugitive and the stranded
it lasted for a couple of hours
a little bit more than the last one but
it was more like a python switch
they started and automatically dropped
it
now this is an analysis from binator
we are interested in those trends that
have the inspect button in red
because those are the market hashtags we
want to follow
melissa's misogynist has almost 2 000
interactions
and it's number first in the threads but
look at number two
that means in spanish the life we want
it only has a hundred
ten why so much difference
remember that we have uh only subscribed
70 users to venator
so are you going to tell me that 70
users just
shared iglesias misogynist
two thousand times that's pretty weird
now what about the pro smugglers 60
this means that a couple of this account
haven't engaged in that hashtag
now take a look at the other one the
stranded and the fugitive
21 interactions that's pretty few
and remember that
users tend to tweet
these hashtags more than once
so there's a high chance that a lot of
people
are just alone tweeting and retweeting
this hashtag
and this doesn't represent for example
21 real users here
this can belong all to the same account
so as you can see most of these
hashtags these strengths are politically
motivated
but we can stop due to a time constraint
we can't stop to analyze each one of
them
so let's keep going let's see this
details and distribution this is a
blacklisted hashtag i've liked
it myself in order to binator to be able
to analyze it
it was seen almost 2000 times as i say
on 70 users and these are the users that
share this hashtag the most look at the
count columned
one of them shared it 136 times
other people shared it almost a hundred
times
now go ahead and tell me that this is
not a coordinated campaign
let's go ahead now vinator identifies
this user with this avatar
that it's a fake one now i will explain
identify this user as the top
distributor
and then other distributors follow him
or her
let's take a look at this user
but first before making accusations so
lightly
let's do a fast rewind and let's try to
remember
how to spot those trolls i told you
back then that this information will be
important later
so now's the time default settings
remember this if you like a profile
picture or if you're using a fake or
stock one
or if you are using one that represents
a
celebrity or something else
be network will take that as a negative
score
lots of numbers in your handler for
instance if i had
recombilage278878
won't like that if you have a lot of
numbers that's probably means that you
haven't changed
your default username given by twitter
the platform
if your if your selected name is not
available will give you one
followed by a string of numbers
remember that trolls share a common
language
common themes and phrases so if you
tweet
like a troll binator will trade you like
one
remember that they agreed to a common
version to answer debates
so again treating specific things
will make venator create a relationship
between you
and the malicious hashtag and the strong
behavior
remember that they never come along
that's why binator has
a blacklist user follow check you can
blacklist different users and with it
we did blacklist the leader of this
propaganda paratus arielgarbars
so if an account is following him this
will take away points
from the from its reputation that's the
idea to
start generating a network to see
what are different aspects that can be
dangerous to this social network that
can be toxic
that can be part of a collective effort
to to spread this toxicity
so let's check this user
automatically you can see that this
avatar
belongs not to this person the person
depicted here is the vice president
fernandez
with a political slogan then the rescore
rises to the max highly suspicious
behavior but why
just because this person thinks
different than other
people no it's not because it's because
all of this take a look
this person has joined it three years
ago so that's okay for pinata
it has more followers than followers
this
doesn't takes a lot of score from its
reputation
but if you have for example 5000
following
and 0 followers it will definitely
take some score risk it will absolutely
add some risk to your score
if you divide the quantity of tweets by
the quantity of years
this account has been active it gives us
the idea that it has little activity
this won't take away score but will
raise a batch
at the end to notify this this is a
non-verified user this
doesn't affect the final score has no
activity has
it has been involved in dangerous
activity why
because it has malicious hashtags and it
has tweeted them
more than the normal you can have
twitter
once using a hashtag market as malicious
twice or even three or four times
but going beyond that number would
trigger veneto to start counting
malicious attempts and adding different
um and sorry i'm taking
different numbers of reputation from
yourself
also this user follows our blacklisted
user
so obviously all of these are is really
respectful
and doesn't seem normal at all
now let's take a look at another profile
the number two
so this will be the the last one was the
top top distributor this will be the
second one
it has obviously a fake profile this is
diego maradona the
soccer player the risk score is fairly
high
and it's treated as malicious because
this
user has an outstanding activity if you
take a look
it was it is an all account four years
old
it has little difference between
following and followers
but the account if you divide this
number
seventy thousand tweets on four years
i can guarantee this give you a lot of
tweets more than the normal
more than the average joe will do it on
a normal day
so we have outstanding activity and this
outstanding activity
it's it's tired
to tweeting malicious hashtags so this
is obviously a malicious effort
again we can easily see that this is not
a real account
now a third one as you can see this lady
here is our vice president once again
i think this is from a couple of years
ago so the risk score again
is highly suspicious but why
look at this this is an account that was
recently created less than a year
ago or not a couple yeah
i think it's uh yeah
so it was recently created
it has just a few more following than
followers so this is not making up this
score
but once again it's using
this account for tweeting in an
outstanding way it has an outstanding
activity
in less than a year this person treated
14
000 times that's a lot
i also reduced different
hashtags that were writes adobe
suspicious
in this case he treated only once our
blacklisted hashtag
but it also has a suspectful handler
this means that it has a couple of
numbers
and it was recently created so the score
tries it and actually vienna was right
this is not or not this is not a real
account this is not a real profile
going to the next one the fourth one it
says in spanish
something like always by your side and
again this is vice president fernandez
so risk scores fairly high again it
should be around the
in the order of the 6070 i think
sorry so uh this account is 11 years old
this definitely looks like a legit
account but the photograph
is not real take a look at the batch
below it says default pictures
this means that either there's no
background picture
not no profile picture or a default one
or a picture that was marked by
ourselves as
a stock stock picture or fake picture
or celebrity picture so this will be
automatically rendered as
default picture it will receive the same
score penalty
this is the first case where the account
has more followers than following
and that looks normal to venator
nevertheless the score
won't go down tweets
again an outstanding activity but
only one of these uh hashtags
were malicious
so moving forward and here we have the
best camouflage award
this is the not my damn job award
from this year this guy absolutely
didn't
give any single f
he only left the default profile and
started tweeting
like that so
i would like you to take a last look at
this
at all this profile and this fabricated
trend
add all these fabricated users and now
tell me again how much you trust
information on social media
especially on the politics side
okay it's time to say goodbye sadly
conclusions are that even if it seems
obvious always inform yourself through
professional
and verified sources i know that they
are not always available
and they are not easy to get but try
and just because a word or a phrase
are trending it doesn't mean that it is
for real
or that it represents the thinking of a
majority
remember that every day somewhere and
sometimes people
pay for this groups of people and
machines work together to install biased
thoughts
and debates in society so
that's why you should really choose
verified sources
because if you haven't seen before in
this talk just a few slides back
will you really trust whatever comes
from social media
if you want to get in touch with us we
are available on twitter we're always
happy to reach out and if you have any
questions
or anything you want to share with us
projects or anything you're working on
you can found us here and we are also
available in github if you want to clone
this project
or to take a look at the first
investigation we did last year
everything will be linked there
so if you have any questions we are
happy to answer them at the discord
server
before we go i would like to uh to give
a heartful
thanks to sandeep and his team for
inviting us today
so take care and we are we will be
waiting at the
discord channel if you have any
questions