Hello world, today we have an interesting and totally not divisive topic.
So, Meta and Twitter have purged hundreds of accounts apparently spreading pro Western
propaganda.
This follows a report which has only just blown the lid on a five year long “pro-Western
covert influence operation” - in other words, bot accounts on Twitter, Facebook and Instagram,
promoting pro-western political narratives.
This is quite remarkable because whilst we’re used to hearing about Russian or Chinese bot
armies, this is the very first time a pro-Western influence campaign has been discovered on
social media - apparently we have a clone army too.
So, this “influence operation” targeted Asia and the Middle East, with the bots posting
about political issues relevant to those areas - one bot for example, was observed promoting
the narrative that the US is helping Tajikistan secure it's border with Afghanistan, and this
other one promotes the US as a source of stability in Asia.
Also, bots apparently love memes just as much as the rest of us, with one account posting
an image of an Iraqi politician with IS militants dancing on his shoulders, and another meme
pushed the idea that Putin doesn’t care about minorities.
Not very spicy memes imo - I find when the main purpose behind a meme is to push a political
narrative, there doesn’t tend to be much meme magic.
On occasion the accounts would take a break from posting about politics, and try to cover
their tracks camouflaging the fact that they’re bots, by posting random cat pictures.
What's notable about this operation is its sheer scale, or well - lack thereof.
It comprised of just 200 bots, which doesn’t sound like much, and it raises the question
- how do we know that these are bots and not just random real people who happen to like
Western policies?
Well - the researchers split the accounts into groups, based on the geographical areas
that they were trying to influence, and plotted their posts per day on the different social
media platforms, the purple bars here represent Instagram posts, and you can clearly see all
the different groups switched to focusing on Instagram literally on the same day earlier
this year, suggesting the accounts are all controlled by one, single, entity.
Things get more interesting when you look at a breakdown of when the accounts actually
post.
This chart shows the second of the minute that the accounts posted.
If there were real people behind these accounts you'd expect this to be random and evenly
distributed - however we can clearly see that the accounts almost always post exactly on
the minute, suggesting that the posts are automated.
Also, the profile pictures of the bots often used faces generated by neural networks, which
pretty is easy to discern because if you overlay the photos, the eyes of all the different
pictures align - a common trait of AI generated faces.
On top of that, in one profile picture, the guy's ear looks kinda weird malformed, and
the background looks kinda trippy and unintelligible - again, a key sign that the picture was generated
by an AI.
However, the whole campaign seems to have not been not very effective, with the report
detailing that the "the vast majority of posts and tweets [they] reviewed received no more
than [just] a handful of likes or retweets, and only 19% of the covert assets [they] identified
had more than 1,000 followers" - so perhaps this whole operation was done by intelligence
agencies, testing the water, a precursor to a larger operation - or maybe we’re suffering
from a bit of ‘survivorship bias’ by even labelling this campaign as only comprising
of 200 accounts, and that the accounts uncovered are just the tip of the iceberg and a lot
more bots have gone undiscovered.
The report explains that the methodology used by the bots of posing as "independent media
outlets", using "memes", "short-form videos" and so on - are extremely similar to bot campaigns
run by China and Russia, so could this operation be in fact run by them - as an experiment
to see how well a pro-Western bot campaign could perform.
Or is this just Western intelligence agencies learning from the operations of their adversaries?
Neither Twitter or Meta publicly attributed the campaign to any particular organisation,
but “Twitter listed the activity’s “presumptive countries of origin” as the U.S. and Great
Britain, while Meta said the “country of origin” was the U.S.”.
I’m sure you guys have a lot to say on this topic, so let me know what you think down
in the comments.
I’ll of course link the full report by ‘Graphika’ and ‘Stanford’ in the description.
Next up, a white hat hacker has come up with a new way of stealing data from air gapped
computers.
"Air gapped", meaning computers disconnected from the internet - for security reasons,
like in power stations or military bases.
For this new technique to work, malware would have to be installed on the air gapped PC,
though after which it would encode the target files for exfiltration, then it’d transmit
them as ultrasonic sound waves using the computer's speakers.
A malicious phone, sitting nearby, would then record these ultrasonic waves - not using
it's microphone, but rather its gyroscope.
The whole idea, is that the ultrasonic waves are transmitted in the "resonance frequencies"
of MEMS gyroscopes, these are the kinds of gyroscopes used in modern phones.
When the gyroscopes are exposed to these "resonance frequencies" they'll vibrate to the point
where there are errors in their output.
Malware on the phone can record these errors, decoding the data, which results in the target
files.
This is all done silently - at least as far as the human ear is concerned.
Coincidentally the topic of "resonance frequencies" dis actually come up in my previous video,
but as a quick reminder, these are the particular frequencies at which an object vibrates at
it's highest amplitude, this principle can be used by an Opera singer to break a glass
with their voice.
But this raises the question, why not just use a phone's microphone to record the audio,
it sounds a lot easier.
And it would be, but for this technique to work, it needs to use a phone of an unwitting
employee, via a malicious app, or by visiting a certain website - as websites can actually
interface with a gyroscope using javascript.
The benefit of using a phone's gyroscope is that gyroscopic data is considered safe.
Whilst you might think twice about letting an App have access to your microphone or camera,
you probably wouldn't think twice about an app knowing your, orientation.
In a proof of concept video, the string "top secret" is transmitted to a nearby phone.
The maximum range here, is about 6 meters, which does actually seem pretty good... but
there are downsides.
This technique transmits at... 1 byte per second, meaning a 2 Megabyte PDF would take...
555 hours to transmit, that's 23 days.
And this theoretical bitrate would be a lot less irl, because an employee's phone isn't
going to be sitting next to the victim PC 24/7 - assuming it's even allowed in the air
gapped environment at all.
The security researcher behind the paper detailing this new technique, one "Mordechai Guri" has
an array of papers all on different ways of exfiltrating data from air gapped systems
- I actually covered one of his other papers recently, where he repurposes a sata cable
in a victim pc to act as an antenna - but, a common critique of virtually all of these
different methods are that they don't solve the problem of getting malware onto the air
gapped PC in the first place.
And in this case in his latest paper, malware would also have to exist on an employees phone,
and then there's the assumption that the target PC even has speakers.
At the same time as publishing this paper, he also released research on exfiltrating
data using LEDs on an ethernet port, signalling encoded files to a hacked CCTV camera - I'll
leave links to that, as well as his other research in the description.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can be found in the video description, and I’ll
see you in the next video, have a good one.