Using Social Media channels and the Internet in Government-Government warfare

Today New Yorker magazine posted a long article revisiting a semi-obscure detail in the Trump-Russia-Conspiracy story. Late in the 2016 election cycle news broke that Trump Campaign servers had been communicating through an arcane channel with servers owned by Alpha Bank. Alpha Bank is closely connected to Russian President Vladimir Putin and his cronies, and has been tied to Russian Oligarch money laundering activities. This communication is regularly referenced as part of the curious connections between the Trump Campaign and Putin cronies.

A year ago this site ran a story looking into the details, and finding it inconclusive. The story is based on studies of DNS query traffic, and not of actual traffic. A DNS query is made whenever software needs the IP address for a remote computer. The source for the story seemingly had access to query logs for a set of prominent DNS servers, but because they cannot have had query logs for all DNS servers any report they made would be limited. They claimed to have seen a curious pattern of DNS queries between a set of servers owned by Alpha Bank, the Trump Organization, and Spectrum Health (a company connected to the DeVos family).

The new article covers the same territory, and claims to have studied the issue more closely.

Buried in an announcement of changes being made to tighten user data privacy, Facebook admitted most people on Facebook could have had their public profile scraped. Uh, do what? Why is such an admission buried towards the bottom of a jargon-filled blog post? The core failing is a default setting for an obscure search feature in Facebook that has been exploited by some to inappropriately access user data on a huge scale. It may actually be time to abandon Facebook - as one article published recently said, it's time to Replace Facebook not Fix it.

Last weekend it was revealed that Cambridge Analytica and the SCL Group schemed to ..er.. steal may be the correct word .. data from tens or hundreds of millions of Facebook users. Funded by the Mercer Family for manipulating the public to a hard-line-right-wing political agenda, Cambridge Analytica's efforts were used for manipulating the 2016 US Elections, and the company may be at work manipulating other elections. The technology used by the company involves collecting vast amounts of user preferences data, into a big database, and applying modern Big Data algorithms and Machine Learning algorithms to then know how to target personalized advertising directly at individual Facebook users. It's one thing to use this to sell more soap or tobacco, it's yet another thing when the aim is electing political leaders.

Facebook now has a huge target painted on its chest, with politicians and others aiming anger and regulatory oversight at Facebook.

The issue here for Techsparx readers is a big warning -- when we play those silly games on social media networks, pay close attention to the access being requested. What Cambridge Analytica did is create viral games that then collected data from not only the Facebook profile of the person who played the game, but all their friends, and all their likes, and postings, and everything else.

The firestorm around data collection by Cambridge Analytica from Facebook users is about the OAuth protocol, the required notification of access requirements, and whether Facebook actually enforces those requirements. During the OAuth protocol it's required to present the user with a screen describing the level of access requested. Facebook signed an order with the Federal Trade Commission in which Facebook agreed to abide by policies about sharing user data. Facebook may have violated that agreement.

Most people don't pay attention to the notifications in the OAuth signup process. It's likely that the users abdicated their responsibility to make good decisions. Instead they, like lemmings, collectively have played the many zillions of viral games that are shared onto Facebook. It is through such games that marketers and political manipulators alike gather user preference information.

Let's take a look at that process.

Cambridge Analytica, funded by the Mercer Family for manipulating the public to a hard-line-right-wing political, illegally collected a massive trove of Facebook user data, then used Big Data techniques to develop highly targeted advertising meant to influence public opinion. The company was founded when a young computer science researcher focusing on big data machine learning techniques met the Mercers, who promised to give him a free hand and fund his research. What resulted was a massive information warfare weapon used by the Mercer's, and their puppet at Breitbart News Steve Bannon, to manipulate public opinion.

Oh ... and ... there are Kremlin/Putin-connected Russians mixed all through the story.

The issue here for Techsparx readers is a big warning -- when we play those silly games on social media networks, pay close attention to the access being requested. What Cambridge Analytica did is create viral games that then collected data from not only the Facebook profile of the person who played the game, but all their friends, and all their likes, and postings, and everything else.

When it comes to manipulating public opinion around the world, USA's Intelligence forces are just as active as Russia's. Over the last few years Russia's Troll Farms have gotten a lot of attention, and much whoop-de-doo is being made about how Russia hacked the 2016 election, and how Russia is behind a string of electoral problems in many countries ever since. The reality is that USA Intelligence forces are also doing it, and somehow the New York Times (and other news outlets) are ignoring this fact.

The hack of the Democratic National Committee's email service proved crucial to the leaks that brought down the Clinton Campaign in 2016. It's well known that the DNC's IT department ignored warnings from the NSA and FBI for several months. They then turned to a private company, CrowdStrike, because they couldn't trust the FBI to treat them fairly -- given what was going on concerning the FBI investigation into Hillary Clinton's email policies as Secretary of State. CrowdStrike had in its staff a highly experience cyber-security sleuth who had dealt with this sort of attack previously.

If Russia is using Social Media networks to bring down democracies around the world, doesn't that make Social Media networks a danger? Rather than blaming the perpetrator, maybe it's easier to blame their tool. Social media networks are a tool that can be used for positive, or negative, purposes. Just as they can be used positively, to spread useful information or connect like-minded people on a common mission, they can be used for negative purposes, such as to spread lies and deceit. Spreading falsehoods is nothing new, and neither is propaganda a new tool of the elites, and neither is divide-and-conquer politics. What's new is the capabilities of social media networks to automate information sharing to mass audiences. Just as a news outlet like The Economist can use social media networks to spread it's excellent reporting, others can use the same technologies to spread falsehoods.

In US law it is illegal for foreign nationals to purchase political advertising. It is easy for anyone to use the advertising platforms run by Facebook, Google, Twitter, and so forth. Anyone can sign up to run advertising, and Facebook/Google/Twitter et al are raking in tons of cash by showing advertising to their large audiences. The problem comes when someone places illegal advertising -- do these companies have adequate screening to avoid aiding and assisting folks committing fraudulent or illegal advertising?

In this case the concern is foreign governments (such as Russia) placing politically manipulative advertising. It's feared that Russia has launched a "cyber war" spreading propaganda through social media websites, and through blogs, with the goal of manipulating the politics of countries around the world. The war is also a War on Truth, meaning that Russia's goals involve destruction of our sense of truthful facts so that political manipulators can spread any kind of idea as if it's factual.

It's not like Russia is the only organization/country doing this kind of thing. The methods ascribed to Russia are commonplace among online marketers -- using roboticized accounts to pump twitter hashtags -- article spinning techniques to publish variants of the same article to multiple blogs -- etc -- are well known spammy low-integrity methods of gaming the search engines. For what it's worth, Russia does present a greater risk to society-as-a-whole than does a company pushing a new-and-improved soap. That's why Russia is in the crosshairs right now.

In written testimony submitted to the Senate Judiciary Subcommittee on Crime and Terrorism, Facebook admitted as many as 126 million people saw content posted by the Internet Research Agency. That innocuously named organization is a Russian Troll Farm that's thought to be closely allied with Russian Intelligence, and was deeply connected to the social media network manipulations thought to be committed by Russia during the 2016 USA elections. Advertising purchased by the Internet Research Agency is thought to have reached over 11 million people. Twitter's testimony disclosed there were nearly 3,000 accounts linked to the Internet Research Agency, which posted over 130,000 tweets. Another 37,000 accounts linked to Russia, but seemingly not associated with the Internet Research Agency, posted over 1.4 million tweets.

The Internet Research Agency operates out of St. Petersburg Russia. It's known thanks to reporting over the last several years that the IRA employs a large staff who post fact-manipulating content on blogs, or social media posts, or comments on websites. Their tactic is to make "Viral" content that draws attention -- for example they might unleash a flood of tweets on a hashtag in order to generate a trending hashtag that will then get news coverage by news editors looking at whatever is trending on Twitter. Who cares if that trending thing is all phoney-baloney made up nonsense that's politically manipulative?

Late in the 2016 election, news broke that Trump Campaign servers had been communicating through an arcane channel with servers owned by Alpha Bank. Alpha Bank is closely connected to Russian President Vladimir Putin and his cronies, and has been tied to Russian Oligarch money laundering activities. The news came amid other allegations of collusion between Trump and the Russians, and is routinely mentioned by Journalists like Rachel Maddow as part of the rationale for the Trump-Russia-Collusion story.

The news broke in a Slate article that detailed work by a group of Internet Security researchers. The article discusses some kind of database of DNS records that somehow describe the architecture of a set of Internet services that somehow describe a pattern of communication between Trump's organization and Alpha Bank. Reading between the lines of the article, the data source has to be someone with access to primary DNS servers who can gather logs of DNS queries.

Kaspersky Labs has long been a well respected very popular anti-virus software vendor. One clear piece of evidence is that Kaspersky's software was sold through Best Buy, Office Depot, Staples and other high-ranking outlets. This year the evidence has mounted that Kaspersky may have been collaborating with Russian Intelligence, their software has been yanked from those three stores, the US Government has a blanket ban on using Kaspersky's software, and so forth.

A few days ago I posted a summary of the technical aspects to anti-virus software could be used to steal anything out of any computer running the software.

Supposedly Kaspersky Labs used its anti-virus software to steal stuff from customers computers, and this included a treasure trove of NSA hacking tools. The Intercept has written a very deep dive into the technical issues, demonstrating that perhaps Russian Intelligence services instead hijacked Kaspersky's software. Regardless, the discussion shows some disturbing things about how anti-virus software works, and demonstrates that anti-virus software companies have the ability to steal anything from any computer running their software. This makes me even more glad I don't run Windows.

A few months ago the USA Government banned the use of Kaspersky anti-virus software, Best Buy yanked it from their stores and from the computers it sells, etc. Reportedly Kaspersky Labs siphoned a bunch of hacking tools from an NSA employee computer. This involved Kaspersky Labs programming their software to search for specific terms, top-secret NSA programs and the like, and then targeting computers belonging to specific people at the NSA, in order to steal the tools. And -- regardless of whether Kaspersky did it, or whether Russian Intelligence hijacked Kaspersky, that sentence should have sent a chill up your spine. Every anti-virus software maker has the ability to search any computer, and upload any file on any computer. That capability is baked into anti-virus software for legitimate reasons, but could be misused.

Two things are colliding on the Internet: Propagandists desire to spread fake news to influence society-wide-beliefs -- this is a huge portion of Russia's meddling in elections in the USA and other countries; and freedom of speech, freedom to build/publish websites, freedom to use social media networks, etc. Facebook and other Tech Giants are increasingly under fire for having allowed Russia to misuse their platforms, both advertising and social media, to spew out tons of fake news and society manipulation. Facebook's answer is that “The thing about free expression is when you allow free expression you allow free expression”, according to Facebook COO Sheryl Sandberg.

Okay, yes, we understand that any squashing of speach is problematic. But, it's false that Facebook doesn't check advertising before it is posted, and it is problematic when stuff that's portrayed as news is completely false and bogus. Facebook already hires a team of people, moderators, to monitor what folks post on Facebook, and delete material or accounts that prove to be problematic. Why doesn't Facebook do the same for fake news?

Those pesky Russian Hackers may be using Google's Accelerated Mobile Pages (AMP) to make spear-phishing attack, or fake news, websites look like legitimate sites. According to Salon, Google has known about this problem for over a year and done nothing.

A couple years ago Google created Accelerated Mobile Pages (AMP) to speed up internet browsing on mobile devices. The AMP standard defines a limited set of JavaScript, CSS and HTML technologies that are known to behave well on a low bandwidth memory constrained device like a cell phone. In part AMP is a response to the overly bloated nonsense occuring on most websites with autoplaying video and animated advertising that pops up and annoys people.

Salon claims that Russian spear-phishing attacks targeting journalists critical of Russia lead to pages using AMP techniques, making them look legitimate. What makes it worse is that Google serves AMP pages from google.com domains, hence an AMP spear-phishing page portraying itself as a Google alert will look legitimate because it is on a google.com domain.

Russia hacked the 2016 US elections, getting Donald Trump elected in the process, giving us all headaches and the prospect of the USA being ruined. The NY Times and other news outlets have pushed this story from many angles. This particular article covers not the hacks on the election system, but the information warfare that preceeded the election, and has been aimed at other countries as well. It's been widely reported since 2014 at least that Russia-intelligence-service-connected-companies are operating "spam farms" that spew targeted content into social media networks, into blog comments, and into fake-news-blog websites. The purpose of these operations is to make the population believe fictions, and to act on those ficitious ideas.

For example a story surfaced in Germany a couple years ago that a young girl had been raped by Muslim refugees of the sort that have flooded into Germany thanks to the Syrian civil war. The police were covering up the crime, supposedly, for some unknown reason. RT News and Sputnik News acted as amplifiers to other social media postings and protest rallies. The thing is, there was no truth to the story. There had been a young girl arrested who initially told the story of being raped, but then she recanted that story to cover up the truth of some other event in her life. These Russia-connected organizations amplified the false story, and it became a large domestic issue spreading the idea that Merkel was dangerously accepting immigrants who were raping people right and left, and it even became a diplomatic issue between Russia and Germany. All over a piece of fake news amplified by actors connected to the Russian government.

This sort of misinformation can, and has, swayed recent elections. I have collected several news reports on this topic going back a few years at Russia's use of Social Media channels and the Internet in Government-Government warfare

A big question from the 2016 US national elections is just how much influence Russia exerted over the results. It's being widely reported that Russians supposedly hacked the Democratic National Committee email system, and that hundreds of "fake news" websites connected to Russians were set up to manipulate beliefs of the public. There are reports going back to 2014 of Russian 'troll farm' websites spewing fake news to manipulate elections all over the world. Now the Washington Post reports that Facebook discovered they allowed a Russian troll farm company to launch advertising targeting the 2016 election chances of Hillary Clinton and others.

The Department of Homeland Security and the FBI have jointly announced detection of a "BOTNET" operated by "cyber actors" of the North Korean government. They are targeting the media, aerospace, financial, and critical infrastructure sectors. They've identified IP addresses associated with a distributed malware system called DeltaCharlie, that manages North Korea’s distributed denial-of-service (DDoS) botnet infrastructure.

The HIDDEN COBRA group primarily targets computers running older, unsupported, versions of Microsoft Windows. They also target Adobe's Flash Player. The vulnerabilities exploited are known, so the simple cure is to update your system to later versions of Windows or to apply security patches.

If you control what the population believes is true, you can control what that population does. Propagandists have known this for generations. The rise of Nazi Germany was due to "weaponized" misinformation. The Nazi Party owned newspapers that churned out fake news, the Party pushed all kinds of lies including Racial Lies, and ruthlessly squashed any dissenters. In the current time period we're being told that Russia has weaponized a system of social media accounts, websites pushing fake news, and on and on, for the purpose of manipulating elections around the world, and weakening international organizations like the EU and NATO.

I believe that Russia is doing that kind of thing, because Russia has for ages pushed Propaganda. The Russian newspaper "Pravda" (the word Pravda means Truth) famously was full of lies every day. Pravda is still in exactly that business, and other news outlets owned by the Russian Government, like Sputnik News and RT News, also push a highly slanted view of the world (everything Russia does is enlightened, everything the West does is clueless and harmful). Russia's motive? To get NATO off its back without fighting an open war. An information war is the ticket, but the casualty is the sense of Truth we all need.

By determining the scope of information we get as answers to questions, search engines have a lot of power to shape what the population believes.

The game that's on is about controlling what the population believes is the Truth. Governments do it to push policy goals, businesses do it to earn more money, activists might do it to push their cause, and so on.

Russia isn't the only participant in spewing fake news into the world. We're being told The Russians are doing it, and they almost certainly are. But that idea is being pushed to the exclusion of others who are using similar mechanisms. What's the goal being served by pushing "The Russians are doing it" while failing to recognize the techniques are used across governments and industries?

While it's widely reported that Russians built a social-media-warfare system which they're using to undermine elections in the USA and elsewhere, The Intercept has been yelling loudly "not so fast" because the allegations of Russian interference aren't verified. If we want to accuse another government of hacking our elections, or those of Moldova or Bulgaria or Montenegro or France or other countries, there'd better be solid proof, if only because the consequence of such an accusation is a possible war.

Today, The Intercept (the news site that's been calling for caution) released an explosive report detailing an effort by Russian Intelligence services to directly hack into USA election systems. They were anonymously handed a top-secret NSA report, that they've analyzed and verified, detailing NSA's documentation of a "Spear-Fishing" attack launched by Russian operatives against election agencies around the country. The goal appeared to be interfering with voter registration confirmation systems.

It's not known whether the attack was successful, just that it occurred.