What are social media countermeasures?

What are social media countermeasures?

As the guy who pretty much owns the #socialmediacountermeasures on Twitter, I figured it makes sense to give the term some proper definition beyond just 280 characters.

In short, social media countermeasures are those techniques – both automated and manual – of which social media services use when trying to detect, flag, and remove malicious content. And by malicious, I mean the actually harmful content created by scammers and other cyber criminals. Therefore, these countermeasures do not involve enforcing narratives, shadowbanning, or other forms of suppressing freedom of speech in the name of “fighting disinformation (1, 2)”.

The countermeasures these social media platforms use are, of course, a trade secret, and very little amount of information about them is publicly available. Keeping them that way is a competitive advantage and makes criminals’ lives harder. We can however deduce that all major platforms have long since evolved beyond using simple blacklist of words or URLs as means of detecting malicious content. Behavior analysis seems to be the area of focus these days, as the social media companies can hoover up massive amounts of usage data from real users and then build a model around that. This behavior model alone isn’t enough though, as it only gives us some sort of average, or an acceptable variance, of typical behavior, but it lacks context. Without context a model like that can still detect for example bot-driven copypaste spamming campaigns easily, but when a person writes (at least seemingly) manually messages aiming to scam or phish a specific individual, detecting becomes a lot harder.

That’s way I’ve seen criminals deploy automated tactics that simulate normal behavior, such as introducing a false delay before auto-answering a message or a tweet, or sometimes even creating fake conversations between bots, and in those “conversations” they happen to promote a scam service and so forth.

These could be called counter-countermeasures. It’s a forever cat-and-mouse game between defenders’ tools and attackers’ criminal-cunningness. This is the reason why while most of the spam messages, e.g. YouTube comments, will end up automatically in the “Held for review” folder (so countermeasures caught them), a few will evade detection and end up among the legitimate comments.

Recently I saw a very interesting malicious campaign in YouTube comments, utilizing stolen accounts and impressively contextual and real looking comments. I did however immediately recognize it for what it is, and this once again begs the question: how on earth it didn’t get detected by YouTube’s countermeasures, while it was so blatantly obvious to me? Unless you get a job working in YouTube’s countermeasures unit, you’ll never know.

I will make another blog post about that campaign though. It’s a very interesting example of using multiple layers of the site’s features in order to lure victims into a specific website. It’s a bit NSFW so I need to figure out first if I need to sanitize my screengrabs or not.

Finally, I’d like to remind everyone to report all scam messages. Reports do improve the detection rate in the future! I shared this tip also in November 2022 issue of F-Alert, the monthly threat report by F-Secure. Feel free to download the report and read my article about a curious Facebook scam targeting Page Admins.

Social Media Countermeasures – Battling Long-Running Scams on YouTube, Facebook, Twitter and Instagram

Social Media Countermeasures – Battling Long-Running Scams on YouTube, Facebook, Twitter and Instagram

For the past few years, I’ve been documenting, screenshotting, and sharing examples of criminal campaigns on the three big social media platforms: Facebook, YouTube and Twitter. I’m not that interested in speculating whether or not something is fake content, falsely amplified by nation-state sponsored threat actors (i.e. coordinated inauthentic behavior), but instead I’ve been focusing on two (a lot less media-sexy) themes:

  1. low-tier criminals using these platforms to promote their services
  2. so called “support scams” targeting mainly Facebook page owners

What is common across these two is the fact that they keep getting through social media platforms’ automatic filtering. I call this filtering – the good-willed type, not the censorship type – social media countermeasures. A term I think I picked up from Destin who runs Smarter Every Day YouTube channel, but I haven’t really seen it used. In a nutshell, social media platforms are trying to create countermeasures to prevent malicious behavior on their platform, and at the same time cyber criminals are developing counter-countermeasures to bob and weave their way around detection and filtering. Sometimes these criminals simply operate in a grey area not covered explicitly by a platform’s Terms of Service, making developing effective countermeasures even harder. Let’s take a look at few examples.

Continue reading “Social Media Countermeasures – Battling Long-Running Scams on YouTube, Facebook, Twitter and Instagram”

The Curious Case of Automated Instagram Influencer Sponsorship Emails

The Curious Case of Automated Instagram Influencer Sponsorship Emails

If an email sounds too good to be true, we’ve learned to dismiss it as phishing or otherwise fraudulent, even if it managed to evade the email client’s junk filters. However, I’ve seen a rise of new type of automated emails that deserve a closer look, as they behave quite differently from your average spam. These emails are from seemingly legitimate businesses, targeting specific email addresses associated with Instagram Creator accounts, and offering some type of an influencer marketing deal.

Global influencer marketing spend is growing rapidly, and Instagram grabbed a lion share – 8 billion dollars – of it during 2020. So, it’s not out of the question for even smaller Creator accounts to get approached by (smaller) brands, but there’s definitely something fishy about the following emails. Let’s look at some examples.

Continue reading “The Curious Case of Automated Instagram Influencer Sponsorship Emails”

Freedom of Speech in the Age of Privacy Policies

Freedom of Speech in the Age of Privacy Policies

(I got access to thinkspot beta and this was my first post on that platform. I decided to crosspost it here to increase awareness of thinkspot, and also because the issues I raise here are relevant on other social media platforms as well.)

 

Hi, I’m Joel, and I eat Privacy Policies for breakfast.

I’m thrilled to be among the first users a social platform that encourages free speech and exchange of ideas, driven by the idea of diversity of minds – the true diversity – not the superficial diversity of how we look or where we come from. However, there can be no free speech without privacy. In a similar vein, Snowden famously wrote few years ago that “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” Well I care about both. It makes a lot of sense then for my first contribution on this platform to be an analysis of thinkspot’s Privacy Policy.

All comments are made about Privacy Policy that’s dated to be effective starting August 8, 2019. It seems that they don’t keep an archive of old policies, so I took the liberty to archive this one myself. They do however notify users “in advance of any material updates to this Privacy Policy by providing a notice on the Website or via email”, so that’s a good thing. Here’s some of the most notable parts of the policy.

Continue reading “Freedom of Speech in the Age of Privacy Policies”

Instagram Hardening – Private Profile is NOT Enough!

Instagram Hardening – Private Profile is NOT Enough!

First things first: Instagram is owned by Facebook. As such, no matter your settings or how you operate the app, you can never obtain real privacy on the platform. There exists a decentralized, ad-free alternative called Pixelfed that seems to have been getting some praise, but without personal experiences I can’t say much about it. Still worth the look if you’re thinking about migrating from Instagram.

Alright, now on to the guide. Here are the concrete steps you should take in order to increase your privacy and security on Instagram.

Continue reading “Instagram Hardening – Private Profile is NOT Enough!”

On Twitter Bots, Censorship and Social Media Manipulation

On Twitter Bots, Censorship and Social Media Manipulation

During the past couple of months, there’s been an uptick in discussion regarding social media weaponization, censorship, bots and other manipulation. I’ve been following and participating in this public dialogue with keen interest, especially from the privacy and free speech perspectives. Whereas 2018 was the year of Facebook fiascos, it looks like in 2019 the spotlight has turned on Twitter.

So here’s a blog post about Twitter, made with embedded tweets. Let’s go full meta.

Continue reading “On Twitter Bots, Censorship and Social Media Manipulation”

How to Setup LinkedIn for Better Privacy and OPSEC

How to Setup LinkedIn for Better Privacy and OPSEC

When it comes to privacy and social media platforms, LinkedIn is the necessary evil we have to put up with. While it’s a no-brainer to delete your Facebook account, but as so much of job recruitment revolves around LinkedIn, it’s a lot harder to severe ties with it. Many companies don’t even post their career opportunities anywhere else than on LinkedIn, and prefer applications that come directly through the platform. It’s also a great tool for headhunters to find suitable candidates.

So let’s assume you have a LinkedIn profile, you want to build up your online resume and personal brand, and want to be able to jump on an opportunity if it presents itself. However, you can accomplish all that without revealing every aspect of your professional self for the whole world to see by default. Let’s start of with LinkedIn settings and then move on to behavior on the platform, and other tips.

Continue reading “How to Setup LinkedIn for Better Privacy and OPSEC”

4 Steps to Harden Your Twitter Account

4 Steps to Harden Your Twitter Account

As data breaches and identity thefts are happening left and right, day and night, the best time to secure your Twitter account was yesterday. Here’s four straightforward steps you should take in order to significantly decrease the possibility of your account getting accessed by an outsider. Most of these things are applicable to other online services as well, so once you’re done hardening your Twitter account, take a critical look at your other accounts both on and off social media.

Continue reading “4 Steps to Harden Your Twitter Account”

Why Quitting the Big Five is Bad Privacy Advice

Why Quitting the Big Five is Bad Privacy Advice

The big five – Amazon, Apple, Facebook, Google & Microsoft – have got a stranglehold of our digital life. Not just our digital identities, but almost all of our web experiences are reliant or connected to the technologies of these five companies.

Recently, Daniel Oberhaus from Motherboard and then Kashmir Hill from Gizmodo both experimented by completely “quitting” the Big Five, for four and six weeks respectively. Both of their stories are very insightful and definitely recommended reading for anyone. However, quitting the Big Five is exactly the kind of take on privacy that turns many people off from becoming more privacy aware.

I’ve seen this happen time and time again in r/privacy, where people who have just tipped their toes in the world on online privacy and security are getting barraged with comments like “LOL IF YOU’RE NOT USING LINUX YOU’RE SCREWED” and “YOU NEED TO DELETE ALL SOCIAL MEDIA ACCOUNTS”. But if we as a privacy community would dial back our tone just a bit, I think we could do way more good than what we’re doing right now.

Continue reading “Why Quitting the Big Five is Bad Privacy Advice”