Botnets Have Infiltrated The Twitterverse

The rise of the Twitter bot has plagued the online world in recent years. These are Twitter accounts that are automated and require little or no human intervention. Many are entirely legitimate, publishing headlines and links to news stories.

But others are malicious. These Twitter bots produce spam, provide fake followers for anybody willing to pay, and can manipulate debates and public opinion in insidious ways that are hard to track and prevent. The effects of large swarms of Twitter bots, so-called botnets, are largely unknown.

That’s why Twitter has an ongoing program to detect and remove malicious bots. But as soon as a new technique becomes available to identify these accounts, bot-masters modify and upgrade their charges to avoid detection.

The truth is that nobody knows how many Twitter bots are out there or how big the botnets have become.

Except now, thanks to the work of Juan Echeverria and Shi Zhou at University College London. These cybersecurity experts have stumbled across a Twitter botnet consisting of more than 350,000 automated accounts, a network of almost unimaginable proportions, that has existed undetected since 2013. They call this network the “Star Wars botnet” and say that its longevity raises serious questions about the potential impact of botnets and the way they are tracked and monitored.

Echeverria and Zhou discovered this botnet almost by accident. Interested in finding automated accounts, the researchers began by downloading details of six million English-speaking Twitter accounts that they randomly selected. That’s about 1 percent of the total number of Twitter accounts.

Twitter allows the most recent 3,200 tweets to be downloaded along with any geo-tags attached to the tweets. This allowed Echeverria and Zhou to map the locations of all these tweets. That’s when they noticed something strange.

For the most part, the geographical distribution of tweets matches the global population distribution. In other words, tweets are more common in densely populated areas like cities. But the researchers also noticed a significant number of tweets, some 23,000 of them, that were geo-located in uninhabited regions close to Europe and the US, such as in deserts and in oceans.

When plotted on a map, these locations were bounded by sharp edges and corners that formed two rectangles, one around the US and the other around Europe. “We conjectured that the map shows two overlapping distributions,” say Echeverria and Zhou. They thought that one set of tweets must be from real users and so coincided with the population distribution.

But the other must have been created by Twitter bots randomly choosing locations in the two rectangles. The goal, thought Echeverria and Zhou, was to convince other Twitter users that the tweets were created in the two continents where Twitter is most popular.

A simple assessment of the 3,000 accounts that created these tweets showed they had much in common. These accounts had never published more than 11 tweets, they never had more than 10 followers and less than 31 friends. They were all produced by Twitter for Windows phones.

But reading the tweets, Echeverria and Zhou realized that they all contained random quotations from Star Wars novels with hashtags inserted at random.  A typical tweet is: “Luke’s answer was to put on an extra burst of speed. There were only ten meters #separating them now.”

At this point, Echeverria and Zhou conjectured that they had stumbled across a single botnet, presumably controlled by a single bot-master. This botnet was obviously large since 3,000 bots had appeared in a random search. And that raised an obvious question: just how big was this botnet?

To find out, the researchers trained a machine-learning algorithm to recognize Star Wars bots and set it loose on a much larger database of 14 million English-speaking Twitter users.

The results were a shock. The machine-learning algorithm, with the help of some manual filtering, found some 350,000 accounts that had the same characteristics. These accounts had never tweeted more than 11 times, had fewer than 31 friends and were all produced by Twitter for Windows Phone.

What’s more, this entire botnet was created in just a few days in June and July 2013. At the time, it produced 150,000 tweets a day.

Then it stopped. “When the creation of new Star Wars bots stopped on 14 July 2013, all the bots suddenly fell silent and remained so ever since,” say Echeverria and Zhou.

But the accounts have not been closed down or deleted. They could all tweet at a moment’s notice, should the bot-master so decide. Echeverria and Zhou say the bots have avoided detection because they were deliberately designed to keep a low profile. “It seems the Star Wars bots were deliberately designed to circumvent many of the heuristics underlying previous bot detection methods,” say Echeverria and Zhou.

The bots do this by tweeting quotes from novels to avoid machine-generated language, which can be easily detected. They never tweet urls or mention other Twitter users. And they have tweeted only a few times each to avoid detection for over or under use.

So what might these fake Twitter accounts be for? Although the accounts have been silent for some time, this makes them valuable since they are less likely now to be labeled as fake. For this reason, pre-aged bots have significant value on the black market.

Echeverria and Zhou say that about 15,000 of the Star Wars bots have followers from outside the botnet. “The only plausible explanation is that these bots have already been sold as fake followers,” they conclude. So whoever owns this botnet is already cashing in.

But it is possible that the entire botnet could be for sale. “What if someone offers a good price for purchasing the control of the whole botnet?” ask Echeverria and Zhou.

Clearly, the discovery of this giant botnet raises important questions about the extent to which the Twitter-verse has been infiltrated by bots that can influence the dynamics of conversations, opinions, and even elections. The work leaves open the crucial question of who set up this botnet and why.

And the story doesn’t end there. For anyone who thinks this is as big as secret Twitter botnets are likely to get, Echeverria and Zhou have bad news. “We have recently discovered another botnet with more than 500k bots, which will be reported shortly,” they say.

Technology Review:            The Global War of Narratives and the Role of Social Media:     

You Should Not Trust The Media:
 

« Lloyds Bank Cyber Attack
Cyber Security Protection For Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Blue Solutions

Blue Solutions

Blue Solutions is a consultancy-led, accredited software distributor who provides IT solutions and support to small and medium enterprises.

A10 Networks

A10 Networks

A10 Networks is a leader in application networking, helping organizations of all sizes to accelerate, optimize and secure their applications.

Infoblox

Infoblox

Infoblox solutions help businesses automate complex network control functions to reduce costs, increase security and maximize uptime.

Splone

Splone

Splone is a Berlin-based IT security research team and consultancy. We help improve IT-security by offering red team assements, penetration tests, audits and customized consulting.

Bolt Learning

Bolt Learning

Bolt's Cyber Security eLearning module provides users with an in-depth understanding of cybercrime, how it can occur and what everyone can contribute to preventing it.

FAIR Institute

FAIR Institute

The FAIR Institute is a non-profit professional organization dedicated to advancing the discipline of measuring and managing information risk.

Nonprofit Cyber

Nonprofit Cyber

Nonprofit Cyber is a first-of-its-kind coalition of global nonprofit organizations to enhance joint action to improve cybersecurity.

UNS Inc.

UNS Inc.

UNS is a top services partner for multiple leaders in the global cybersecurity industry – we do business in 40 countries, including the United States, Canada, Chile, and Colombia.

Approov

Approov

Approov provides a comprehensive runtime security solution for mobile apps and their APIs, unified across iOS and Android.

Atlas VPN

Atlas VPN

Atlas VPN is a highly secure freemium VPN service with a goal to make safe and open internet accessible for everyone.

Cambridge International Systems

Cambridge International Systems

For more than 25 years, Cambridge has been fighting bad actors in both the cyber and physical worlds.

Security Risk Advisors (SRA)

Security Risk Advisors (SRA)

Security Risk Advisors deliver cybersecurity services to leading companies in the Financial Services, Healthcare, Pharmaceuticals, Technology and Retail industries.

ExactTrak

ExactTrak

ExactTrak provide embedded cyber security solutions for your digital devices – whenever and wherever you need them.

Backslash Security

Backslash Security

With Backslash, AppSec teams gain visibility into critical risks in their apps based on reachability and exploitability.

Downdetector

Downdetector

Downdetector helps people all over the world understand disruptions to vital services such as the internet, social media, web hosting platforms, banks, games, entertainment, and more.

Xmore AI

Xmore AI

Xmore AI, an emerging disruptor in our incubation, is building AI models to optimize and secure IT with the mission of increasing efficiency and reducing costs.