Vladimir Kropotov, Lion Gu, Fyodor Yarochkin

Senior Threat Researchers @ TrendMicro

HISTORICAL INSIGHTS

#hashthinking and short attention span

http://ecclesiastes911.net/suggestion/https://www.youtube.com/watch?v=fuIXiXqv978

Before: good vs bad Now: vs

TIMELAW:

geolocation:

What we observe as FakeNews is about applying old theories to modern means of communication

https://www.pdf-archive.com/2016/04/02/30408-1/30408.pdf

Positive/Neutral vs Negative comments for two candidates during the elections 2015 @QuestionMore TV channel

Fake news is just a top of the Iceberg

Services on the Market (White? Black? Grey?)

Connect to friends Read news Collect information to make decisions

Shopping Investments Votes ...

Role of social networks

Follower service in DeepWeb market

Services in DeepWeb market

Cross-border availability: Search for follower services (

YouTube 7000top 5

BandWagon EffectAs more people come to believe in something, others also "hop on the bandwagon" regardless of the underlying evidence.

What we expect from Normal Accounts vs Bots

(1-Norm) ~= Anomaly Now it doesnt works, there is no such line, its kind of fuzzy logic

Auto registered accounts with ANtiBan?

vs

Electronic polls and Voting change.org counts?

Properly counting votes in online voting is harder than it seems.

300000 = 150000

Erase Bad stories from the Web

The role of public groups

Case Studies

Federal antimonopoly service threaten to block Facebook, due to Adv of Smoking Blends,

Facebook will be blocked in Russia in 2013

Earning on the collapse of shares - step-by-step guide

The story From 2013...

Twitter Bots

Detecting bot communities

Accounts profile Avatars Followers Following Account lifetime Registration date

Accounts behaviours Posting speed Active hours (how many of you work 24/7) Number of posts per day (no user posts 400 tweets a day at average) Simultaneous activity on promoting topics Timing evaluation (real staff starts slowly) Triggering points (how bots following botmaster) Spotting leading bots (masters) Isolated communities

Detecting bot communities

Convert data to graph (GML) Identify isolated communities Validate retweet/quote only-

accounts as bots

Exploring Twitter-Space with Graphs

#MacronLeaks caseLast minute swing effect? -

#MacronLeaks case

#MacronLeaks case

#MacronLeaks case

#MacronLeaks:

Strategic leak of information 24 hours before election Domestic media is not allowed to comment Social media is uncontrolled and can be bot-manipulated

Donald Trump vs Covfefe

Trump Bot Followers

Bots

Smart bots: cat and mouse game

Bot-assisted promotions

Bot assisted promotions

bots .. bots everywhere :)

https://twitter.com/rich_harris/status/957310634378629121?lang=en

https://www.nytimes.com/interactive/2018/01/27/technology/social-media-bots.html

Media investigations

Twitter handles over the time

Compare Following vs Followers

TrumpIsVeryBad

Political amplification in Bangladesh

Social Media Platform business model: - More users -> More Money (?) - More Information -> More Users -> More Money (?) - More Interractions -> More Information -> More Users -> More Money (?)

Bot activities and services: - create more users - inject more information - create user interractions

PROFIT?!

SN and conflict of Interest

Related research within Trend Micro

https://www.virusbulletin.com/conference/vb2014/abstracts/depth-analysis-abuse-twitter/ https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-an-in-depth-analysis-of-abuse-on-twitter.pdf https://documents.trendmicro.com/assets/white_papers/wp-fake-news-machine-how-propagandists-abuse-the-internet.pdf

https://www.virusbulletin.com/conference/vb2014/abstracts/depth-analysis-abuse-twitter/https://www.virusbulletin.com/conference/vb2014/abstracts/depth-analysis-abuse-twitter/https://www.virusbulletin.com/conference/vb2014/abstracts/depth-analysis-abuse-twitter/https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-an-in-depth-analysis-of-abuse-on-twitter.pdfhttps://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-an-in-depth-analysis-of-abuse-on-twitter.pdfhttps://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-an-in-depth-analysis-of-abuse-on-twitter.pdfhttps://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-an-in-depth-analysis-of-abuse-on-twitter.pdfhttps://documents.trendmicro.com/assets/white_papers/wp-fake-news-machine-how-propagandists-abuse-the-internet.pdfhttps://documents.trendmicro.com/assets/white_papers/wp-fake-news-machine-how-propagandists-abuse-the-internet.pdfhttps://documents.trendmicro.com/assets/white_papers/wp-fake-news-machine-how-propagandists-abuse-the-internet.pdf

Background Fact checks

False Flags Agenda

Conclusion

A word of warning~

Q & A