Hunting Bot Networks
Noam Rotem and Yuval Adam
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5753489/botim.png)
Bots / Avatars / Sockpuppets
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545435/Screen-Shot-2018-07-11-at-11.21.16-AM-768x510.png)
Methodology
- Crowd-source suspicious accounts
- Identify suspicious clusters
- Manual and automated research
Recap - The Turkish Network
Content
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545475/image_5.png)
Suspicious Metadata
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545474/out.png)
Cultural Inaccuracies
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545483/image_15.png)
False Flag
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545486/image_18.png)
Suspicious Cluster
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545462/image_0t.png)
Organic Network
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545465/image_1t.png)
Media References
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545478/image_6.png)
Content
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545481/image_7.png)
The Turkish Connection
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5545491/image_26.png)
Results
- Twitter disclosure
- 142 accounts suspended
Kingdom Salvation
כנסיית האל הכל יכול
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5752661/DyOl9OkW0AA6tK9.jpg_large.jpg)
Israeli Girls Network
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5752700/DyJFxv6XcAADIcW.jpg)
Israeli Girls Network
- Same naming patterns
- All accounts created within 4 hours
- Still active...
Journalists at Risk
Fake News Campaign
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5676998/Screenshot_from_2019-01-16_10-46-19.png)
Fake News Campaign
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5677008/Screenshot_from_2019-01-16_10-50-35.png)
One-time Account
- Old account
- Wiped history clean
- Re-branded as a "legit" account
- Target journalists with DMs and @s
Social Graph Mismatch
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5677004/Screenshot_from_2019-01-16_10-48-23.png)
Tech Infrasctructure
Twitter Data Collection
- Python
- PostgreSQL
- SQLAlchemy
- Celery
Lifecycle
- Twitter API calls
- Response serialization and storage
- Tagging (for research)
- CSV and XLS exports
- Web-based dashboard
- Gephi for graph visualization
מודל לדוגמה
class User(Base):
__tablename__ = 'users'
id = Column(String(20), primary_key=True)
name = Column(String(15), nullable=False)
full_name = Column(Text)
description = Column(Text)
created = Column(DateTime)
location = Column(Text)
protected = Column(Boolean)
followers_count = Column(Integer)
friends_count = Column(Integer)
favourites_count = Column(Integer)
statuses_count = Column(Integer)
listed_count = Column(Integer)
imported = Column(DateTime(timezone=True), default=func.now())
updated = Column(DateTime(timezone=True), onupdate=func.now())
tags = Column(ARRAY(Text), nullable=False,
default=cast(array([], type_=Text), ARRAY(Text)))
followers = relationship('User', secondary=follows,
primaryjoin=id == follows.c.to_id,
secondaryjoin=id == follows.c.from_id,
order_by=follows.c.id,
backref='friends', lazy='subquery')
tweets = relationship('Tweet',
primaryjoin='User.id == foreign(Tweet.user_id)',
backref='user', lazy='subquery', viewonly=True)
__table_args__ = (
Index('ix_user_name_lower', func.lower('name')),
Index('ix_user_tags', tags, postgresql_using='gin'),
)
Project Side-Quest
Honeypot
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5677036/2.png)
Doxxing
![](https://s3.amazonaws.com/media-p.slid.es/uploads/50968/images/5677038/3.png)
Data Collection
- Browser fingerprinting
- WebRTC de-anonymization
- IP leakage
Next Steps
- Crowd-funding campaign
- Continue data collection and analysis
Questions?
Twitter Dev Conf Eng
By Yuval Adam
Twitter Dev Conf Eng
- 1,404