Showing posts with label facebook. Show all posts
Showing posts with label facebook. Show all posts

Saturday, December 04, 2021

Online Shopping Reminder: If It Looks Too Good To Be True ...

As we look towards the Christmas holiday, 'tis the season for freaking out and making poor decisions with regards to online shopping. Tonight a friend reached out to get my help in convincing his family that an incredible laptop sale they saw on laptop was not real.
That's the ad they saw on Facebook.  "Due to special reasons" the company has decided to "sell the last batch of laptops." If you click the Shop Now button, it takes you to the website "maxwellplaceonhudson[.]com"



Now, I'm not saying that everyone who re-uses an image is a scammer, but John J. Rogers and MaxwellPlaceHudson are using a photo from a 2019 Mainichi News article in Japan about the fact that computers were piling up in warehouses in China.  Doesn't that look familiar?  

https://mainichi.jp/english/articles/20191223/p2g/00m/0bu/050000c

John J. Rogers is being an extremely helpful and interactive salesperson as people are asking him how long it takes to ship the laptops.  He's giving recommendations on which model to order, and estimates on shipping time.




But How Do We Know It's Real?  ... Testimonials!

Just look at all the happy customers! "Sdhuy Fhabn" says "This is a quality built and spec'd laptop! Very satisfied!"
Strange that all of the comments on Sdhuy's page are in Filipino.  Even stranger? Someone named Tonie Pomintel thanked the computer seller "Memasabe" for a laptop using exactly the same words!

Mandy also loves his new laptop.  "Mine has arrived, this is an unexpected laptop, it even has a touch screen, I like it very much!" he gushes.

Mandy lives in Quezon City, Philippines, which does make it seem odd that he would be mail-ordering a laptop from New Jersey.  Even stranger?  "Ams Minang" shared exactly the same image to thank "Memasabe" for her new laptop!



MD tells us "So far so good, works great, looks great!" 
But then, for MD, people who look like John J. Rogers are kind of "his type."
I'm sure that Mandy and Sdhuy are fine people.  But let me tell you friends, MD, he's a Scammer!
MD Sajjad is a fake account that is giving a fake testimonial.

Take a look at his Facebook "Likes" -- 

He likes John J. Rogers, Noah Robert, Oliver Noah, Sean M Hemming, Debra Carter, Gerry R Frederickson, George S Krebs, and RiodiJanero ... who surprisingly all have the same two profile pictures!

Romance Scam and Online Fraud expert "FireFly" at www.scamsurvivors.com let us know that one of these men is the model "Michael Justin."  The profile picture is swiped from a 16MAY2019 post by Instagram user @themichaeljustin: 
https://www.instagram.com/p/Bxizn4iFWXy/ (@themichaeljustin)

The other primary profile picture is from a photo sales site and is entitled "businessman with laptop thinking at night office." 
https://photodune.net/item/businessman-with-laptop-thinking-at-night-office/20174205



Let's look at what else they have in common!


Noah Robert is a "Computer Company" ... oh gee! On November 25th "due to special reasons" he starting selling computers from his website "ajakubowski[.]com"

You may be surprised to know that ajakubowski's website is IDENTICAL to  MaxwellPlaceHudson's website!

His telephone number is in Afghanistan. (+93 is international dialing code for Afghanistan.)

Email ioiw7nkrvs@claimab.com

https://www.facebook.com/Noah-Robert-103879551585935/

Oliver Noah is a Computer Company. You'll never guess! Due to Special Reasons, he's selling the last batch of his laptops! 

His website, "utoal[.]com" strangely looks EXACTLY like John's website!

Sort of odd that he has an Afghanistan telephone number (+93)

Email n7x1z325fk@thrubay.com

https://www.facebook.com/Oliver-Noah-100751858389405/

Sean M Hemming is a Computer Company . Guess what! Due to Special Reasons, he's selling the last batch of his laptops! 

He has an Afghanistan telephone number and his website is MarbleTownGreen[.]com. (But it's closed down now.)

https://www.facebook.com/Sean-M-Hemming-769171696455694/

Facebook tells us the Page Manager location is Bangladesh


Debra G. Carter is a Computer Company. Guess what! Due to Special Reasons, he's selling the last batch of his laptops. He has a +93 Afghani telephone number and his website is "teamlse[.]com"

https://www.facebook.com/Debra-G-Carter-746064202423878/

Facebook tells us the Page Managers are in Indonesia, Liberia, Saint Vincent, and the Grenadines.


You might already be able to guess on this next one.

Gerry R Fredericksen is a Computer Company. 

Due to Special Reasons, he's selling the last batch of his laptops. 

He has a +93 Afghani telephone number and 

His website is "legeb[.]com" is currently disabled.

https://www.facebook.com/Gerry-R-Fredericksen-104079251980543/


George S Krebs is a Computer Company. 

Due to Special Reasons, he's selling the last batch of his laptops. 

His email is "esi01uo8d15@claimab.com" 

His website is "highlyacceleratedstresstest[.]com" is offline.

https://www.facebook.com/wo.kya.hoti/


RiodiJanero is a Computer Company. 

Due to Special Reasons, he's selling the last batch of his laptops.

His email is xdwdseiwb6@linshiyouxiang.net

His website is PineappleHillDesigns[.]com is offline.

He has a +93 Afghani telephone number.




So, getting back to the original question:  

Actually, I'm thinking that you may not really be able to buy a $2,600 laptop for $79 and have it delivered anywhere in the world in time for Christmas.  But then, my friends all tell me that I'm paranoid.

And there's so many more ... 

 
another Fake testimonial account: https://www.facebook.com/ams.minang.5/likes 

https://www.facebook.com/antonia.pomintel.5/likes_all

  • Helen Z Picket
    • https://www.facebook.com/Helen-Z-Pickett-111752013985708/
    • http://andaluciapropertyservices.com/
    • (216) 755-9391
  • Jackie K Freund
    • https://www.facebook.com/Jackie-K-Freund-448774108917513/
    • http://affordablegreensystems.com/
  • Andrew H Doyle
    • https://www.facebook.com/Andrew-H-Doyle-105266824762892/
    • http://affordablegreensystems.com/
    • +93212-307-8110
  • Memasabe
    • https://www.facebook.com/Memasabe-103806308164677/
    • http://snvpL.com/
    • +93803-520-1898
  • Fernando
    • https://www.facebook.com/Fernando-1894457434202054/
    • http://caughtfromabove.com/
    • 6trmfvuo2sh@thrubay.com
    • +93704-927-4239
  • Anne P Dudley
    • https://www.facebook.com/Anne-P-Dudley-141541912968147/
    • http://fricade.com/
    • y38msxh8zps@claimab.com
  • Dean B Vigil
    • https://www.facebook.com/Dean-B-Vigil-116775383783140/
    • http://fmpcms.com/ (live) 
    • +93816-539-3967
    • shhk60jhpng@claimab.com
  • A Addawd
    • https://www.facebook.com/A-addawd-100571795787651/
    • http://schoolbackpackstore.com/ (live) 
  • Criative
    • https://www.facebook.com/criativcalcad/
    • http://fourteenkaratomaha.com/
    • 5c992xqncjc@thrubay.com
  • My House 
    • https://www.facebook.com/My-House-100743925704289/
    • https://konamitech.com/ nbsp;(live) 
    • +213717-630-6321
    • gv2q360p9q@claimab.com
  • Helen T Lewis
    • https://www.facebook.com/Hector-T-Lewis-106551108311154
    • http://stevestoyboxny.com/
    • +93304-763-9483
    • ftxwy0rlela@linshiyouxiang.net
  • Leonia D Hill
    • https://www.facebook.com/Leonia-D-Hill-107212691802456/
    • https://chealyjean.com/
    • +93361-299-6243
    • ioiw7rnkrvs@claimab.com
  • Kermit
    • https://www.facebook.com/Kermit-119766538090600/
    • http://certificadoscolombia.com/
And the network is even bigger, because they also have female fake store owners selling Mobile Phones: 


Monday, November 18, 2019

Facebook's Transparency Report: (Expert) Supervised Machine Learning Works!

Last summer the BBC technology program "Click" came to visit the lab for a special called "Can Technology Solve the Opioid Crisis?"  One of the points we stressed with @NickKwek was that when we report opiods and fentanyl-related posts to Facebook the objective is not to take down THAT POST, but rather to help Facebook's automated tools update their models of what offensive drug sales content looks like.

Last week we had an opportunity to see what that looks like in action as Facebook released their transparency report for Q3 2019.  Facebook's Transparency report is divided into two major sections which each have two subsections. "Enforcement of our Standards" covers "Community Standards Enforcement" and "Intellectual Property Infringement."  The other major section, "Legal Requests" is divided into "Government Requests for User Data" and "Content Restrictions Based on Local Law."

The November 2019 transparency report for Community Standards looks at ten categories of content on Facebook and four categories of content on Instagram.

In this post, we'll look primarily at the statistics for "Regulated Goods: Drugs and Firearms" but the other categories on Facebook are:

  • Adult Nudity and Sexual Activity
  • Bullying and Harassment
  • Child Nudity and Sexual Exploitation of Children
  • Fake Accounts
  • Hate Speech
  • Spam
  • Terrorist Propaganda
  • Violent and Graphic Content
  • Suicide and Self-injury
On Instagram, the other categories are:
  • Child Nudity and Sexual Exploitation of Children
  • Suicide and Self-injury
  • Terrorist Propaganda
Facebook has shared previously about our work to reduce terrorist content on their platform.  See their "Hard Questions" blog post -- "Are We Winning the War on Terrorism Online."  In this most recent report, they share that "Our proactive rate for detecting content related to al-Qaeda, ISIS and their affiliates remained above 99% in Q2 and Q3 2019, while our proactive rate for all terrorist organizations in Q2 and Q3 2019 is above 98%."

What does that mean?  It means that through the power of machine learning, when someone posts content trying to "express support or praise for groups, leaders, or individuals involved in terrorist activities" the content is removed automagically without the need for anyone to report it 98-99% of the time!

They've also previously discussed our relationship regarding the Opioid Crisis.  See their post "Supporting Our Community in the Face of the Opioid Epidemic." 

As Facebook has focused on identifying drug-related content, the number of detections has risen.  That's likely from two reasons -- one, they are now discovering content that previously would have remained unreported in the past; but also two, frustrated users are attempting to post their drug sales information in more ways trying to get past the blocks -- and largely failing to do so.

Drug related posts actioned:
  • 572,400 posts in Q4 2018
  • 841,200 posts in Q1 2019 
  • 2,600,000 posts in Q2 2019 
  • 4,400,000 posts in Q3 2019
When I attended Facebook's Faculty Summit all the way back in 2016  they had me hooked from the very beginning of the day when Facebook's Engineering Director Joaquin Quinonero Candela gave his opening keynote.  All of this amazing machine learning technology that people like Dr. Candela had created to help improve online ad delivery were ALSO being used to make the platform as safe as possible against a wide variety of threats. I was especially excited to learn about the work of Wendy Mu. At the time Wendy's bio said "Wendy is an engineering manager on Care Machine Learning, which leverages machine learning to remove abusive content from the site.  Over the last three years at Facebook, she has also worked on Site Integrity, Product Infrastructure, and Privacy."  Wendy and her team are inventing and patenting new ways of applying machine learning to this problem space.  Nektarios Leontiadis "a research scientist on the Threats Infrastructure Team" with a PhD in online crime modeling and prevention from Carnegie Mellon and Jen Weedon, previously at FireEye, were some of the other folks I met there that made such a profound impression on me!  Since then, the UAB Computer Forensics Research Lab has partnered with Facebook on many projects, but quite a few have taken the form of "what would a human expert label as offending content in this threat space?"

This is where "supervised machine learning" comes into play.  

The simplest version of Supervised Machine Learning is the "I am not a Robot" testing that Google uses to label the world.  You may be old enough to remember when Google perfected their Google Books project by asking us to human label all of the unreadable words that their scanner lifted from old books, but which were not properly recognized by their OCR algorithm.  Then we were asked to label the address numbers found on buildings and mailboxes and then later to choose cars, bicycles, traffic lights, and more recently cross walks as it seems we are not teaching future self-driving cars how to not drive over pedestrians.

This works well for "general knowledge" types of supervised learning.  Anyone over the age of three can fairly reliably tell the difference between a Cat and a Dog.  When people talk about supervised machine learning, that is the most common example, which comes from the concept of "Convolutional Neural Networks".  Do a search on "machine learning cat dog" and you'll find ten thousand example articles, such as this image from Booz Allen Hamilton.

Booz Allen Hamilton infographic 


We're working on something slightly different, in that the labeling requires more specialized knowledge than "Cat vs. not Cat".   Is this chemical formula a Fentanyl variant?  Is the person in this picture the leader of a terrorist organization?  What hashtags are opioid sellers using to communicate with one another once their 100 favorite search terms are being blocked by Facebook and Instagram?

Facebook Research has a nice set of videos that explain some of the basics of Machine Learning that are shared as part of the "Machine Learning Academy" series:

from: https://research.fb.com/videos/field-guide-to-machine-learning-lesson-1-problem-definition/
In this chart, the data provided by UAB is primarily part of that "Data Gathering" section ... by bringing forensic drug chemists into the lab, we're able to provide a more sophisticated set of "labelers" than the general public.  Part of our "Accuracy testing" then comes in on the other end.  After the model built from our data (and the data from other reporters) is put into play, does it become more difficult for our experts to find such content online?

Looking at the Transparency Report's Community Standards section, the results are looking really great!  


In the fourth quarter of 2018, only 78.6% of the offending drug content at Facebook was being removed by automation.  22% of it didn't get deleted until a user reported it, by clicking through the content reporting buttons.  By the 3rd Quarter of 2019, 97.6% of offending drug content was removed at Facebook by applying automation!

In Q4 2018, 122,493 pieces of drug content were "manually reported" while 449,906 pieces were "machine identified."

In Q3 2019, 105,600 pieces of drug content were "manually reported", but now about 4.3 million pieces were "machine identified."  

Terror Data

Twitter also produces a Transparency report and also shares information about content violations, but in most categories lags far behind Facebook on automation.  Twitter's latest transparency report says that "more than 50% of Tweets we take action on for abuse are now being surfaced using technology. This compares to just 20% a year ago."  The one category where they seem to be doing much better than that is terrorism.  Their last report covered the period January to June 2019.  Twitter does not share statistics about drug sales content, but does have Terrorism information.  During this period, 115,861 accounts were suspended for violations related to the promotion of terrorism.  87% of those accounts were identified through internal tools.  

Facebook doesn't share these numbers by unique accounts, but rather by the POSTS that have been actioned.  In the Q3 2019 data, Twitter actioned 5.2 million pieces of terror content.  98.5% of those posts were machine identified.





Monday, October 22, 2018

Project Lakhta: Putin's Chef spends $35M on social media influence

Project Lakhta is the name of a Russian project that was further documented by the Department of Justice last Friday in the form of sharing a Criminal Complaint against Elena Alekseevna Khusyaynova, said to be the accountant in charge of running a massive organization designed to inject distrust and division into the American elections and American society in general.

https://www.justice.gov/opa/press-release/file/1102316/download
In a fairly unusual step, the 39 page Criminal Complaint against Khusyaynova, filed just last month in Alexandria, Virginia, has already been unsealed, prior to any indictment or specific criminal charges being brought against her before a grand jury.  US Attorney G. Zachary Terwilliger says "The strategic goal of this alleged conspiracy, which continues to this day, is to sow discord in the U.S. political system and to undermine faith in our democratic institutions."

The data shared below, intended to summarize the 39 page criminal complaint, contains many direct quotes from the document, which has been shared by the DOJ. ( Click for full Criminal Complaint against Elena Khusyaynova )

Since May 2014 the complaint shows that the following organizations were used as cover to spread distrust towards candidates for political office and the political system in general.

Internet Research Agency LLC ("IRA")
Internet Research LLC
MediaSintez LLC
GlavSet LLC
MixInfo LLC
Azimut LLC
NovInfo LLC
Nevskiy News LLC ("NevNov")
Economy Today LLC
National News LLC
Federal News Agency LLC ("FAN")
International News Agency LLC ("MAN")

These entities employed hundreds of individuals in support of Project Lakhta's operations with an annual global budget of millions of US dollars.  Only some of their activity was directed at the United States.

Prigozhin and Concord 

Concord Management and Consulting LLC and Concord Catering (collectively referred to as "Concord") are related Russian entities with various Russian government contracts.  Concord was the primary source of funding for Project Lakhta, controlling funding, recommending personnel, and overseeing activities through reporting and interaction with the management of various Project Lakhta entities.

Yevgeniy Viktorovich Prigozhin is a Russian oligarch closely identified with Russian President Vladimir Putin.  He began his career in the food and restaurant business and is sometimes referred to as "Putin's Chef."  Concord has Russian government contracts to feed school children and the military.

Prigozhin was previously indicted, along with twelve others and three Russian companies, with committing federal crimes while seeking to interfere with the US elections and political process, including the 2016 presidential election.

Project Lakhta internally referred to their work as "information warfare against the United States of America" which was conducted through fictitious US personas on social media platforms and other Internet-based media.

Lakhta has a management group which organized the project into departments, including a design and graphics department, an analysts department, a search-engine optimization ("SEO") department, an IT department and a finance department.

Khusyaynova has been the chief accountant of Project Lakhta's finance department since April of 2014, which included the budgets of most or all of the previously named organizations.  She submitted hundreds of financial vouchers, budgets, and payments requests for the Project Lakhta entities.  The money was managed through at least 14 bank accounts belonging to more Project Lakhta affiliates, including:

Glavnaya Liniya LLC
Merkuriy LLC
Obshchepit LLC
Potentsial LLC
RSP LLC
ASP LLC
MTTs LLC
Kompleksservis LLC
SPb Kulinariya LLC
Almira LLC
Pishchevik LLC
Galant LLC
Rayteks LLC
Standart LLC

Project Lakhta Spending 

Monthly reports were provided by Khusyaynova to Concord about the spendings for at least the period from January 2016 through July 2018.

A document sent in January 2017 including the projected budget for February 2017 (60 million rubles, or roughly $1 million USD), and an accounting of spending for all of calendar 2016 (720 million rubles, or $12 million USD).  Expenses included:

Registration of domain names
Purchasing proxy servers
Social media marketing expenses, including:
 - purchasing posts for social networks
 - advertisements on Facebook
 - advertisements on VKontakte
 - advertisements on Instagram
 - promoting posts on social networks

Other expenses were for Activists, Bloggers, and people who "developed accounts" on Twitter to promote online videos.

In January 2018, the "annual report" for 2017 showed 733 million Russian rubles of expenditure ($12.2M USD).

More recent expenses, between January 2018 and June 2018, included more than $60,000 in Facebook ads, and $6,000 in Instagram ads, as well as $18,000 for Bloggers and Twitter account developers.

Project Lakhta Messaging

From December 2016 through May 2018, Lakhta analysts and activist spread messages "to inflame passions on a wide variety of topics" including:
  • immigration
  • gun control and the Second Amendment 
  • the Confederate flag
  • race relations
  • LGBT issues 
  • the Women's March 
  • and the NFL national anthem debate.


Events in the United States were seized upon "to anchor their themes" including the Charleston church shootings, the Las Vegas concert shootings, the Charlottesville "Unite the Right" rally, police shootings of African-American men, and the personnel and policy decisions of the Trump administration.

Many of the graphics that were shared will be immediately recognizable to most social media users.

"Rachell Edison" Facebook profile
The graphic above was shared by a confirmed member of the conspiracy on December 5, 2016. "Rachell Edison" was a Facebook profile controlled by someone on payroll from Project Lakhta.  Their comment read  "Whatever happens, blacks are innocent. Whatever happens, it's all guns and cops. Whatever happens, it's all racists and homophobes. Mainstream Media..."

The Rachell Edison account was created in September 2016 and controlled the Facebook page "Defend the 2nd".  Between December 2016 and May 2017, "while concealing its true identity, location, and purpose" this account was used to share over 700 inflammatory posts related to gun control and the Second Amendment.

Other accounts specialized on other themes.  Another account, using the name "Bertha Malone", was created in June 2015, using fake information to claim that the account holder lived in New York City and attended a university in NYC.   In January 2016, the account created a Facebook page called "Stop All Invaders" (StopAI) which shared over 400 hateful anti-immigration and anti-Islam memes, implying that all immigrants were either terrorists or criminals.  Posts shared by this acount reached 1.3 million individuals and at least 130,851 people directly engaged with the content (for example, by liking, sharing, or commenting on materials that originated from this account.)

Some examples of the hateful posts shared by "Bertha Malone" that were included in the DOJ criminal complaint,  included these:




The latter image was accompanied by the comment:

"Instead this stupid witch hunt on Trump, media should investigate this traitor and his plane to Islamize our country. If you are true enemy of America, take a good look at Barack Hussein Obama and Muslim government officials appointed by him."

Directions to Project Lakhta Team Members


The directions shared to the propaganda spreaders gave very specific examples of how to influence American thought with guidance on what sources and techniques should be used to influence particular portions of our society.  For example, to further drive wedges in the Republican party, Republicans who spoke out against Trump were attacked in social media:
(all of these are marked in the Criminal Complaint as "preliminary translations of Russian text"):

"Brand McCain as an old geezer who has lost it and who long ago belonged in a home for the elderly. Emphasize that John McCain's pathological hatred towards Donald Trump and towards all his initiatives crosses all reasonable borders and limits.  State that dishonorable scoundrels, such as McCain, immediately aim to destroy all the conservative voters' hopes as soon as Trump tries to fulfill his election promises and tries to protect the American interests."

"Brand Paul Ryan a complete and absolute nobody incapable of any decisiveness.  Emphasize that while serving as Speaker, this two-faced loudmouth has not accomplished anything good for America or for American citizens.  State that the only way to get rid of Ryan from Congress, provided he wins in the 2018 primaries, is to vote in favor of Randy Brice, an American veteran and an iron worker and a Democrat."

Frequently the guidance was in relation to a particular news headline, where directions on how to use the headline to spread their message of division where shared. A couple examples of these:

After a news story "Trump: No Welfare To Migrants for Grants for First 5 Years" was shared, the conspiracy was directed to twist the messaging like this:

"Fully support Donald Trump and express the hope that this time around Congress will be forced to act as the president says it should. Emphasize that if Congress continues to act like the Colonial British government did before the War of Independence, this will call for another revolution.  Summarize that Trump once again proved that he stands for protecting the interests of the United States of America."

In response to an article about scandals in the Robert Mueller investigation, the direction was to use this messaging:

"Special prosecutor Mueller is a puppet of the establishment. List scandals that took place when Mueller headed the FBI.  Direct attention to the listed examples. State the following: It is a fact that the Special Prosector who leads the investigation against Trump represents the establishment: a politician with proven connections to the U.S. Democratic Party who says things that should either remove him from his position or disband the entire investigation commission. Summarize with a statement that Mueller is a very dependent and highly politicized figure; therefore, there will be no honest and open results from his investigation. Emphasize that the work of this commission is damaging to the country and is aimed to declare impeachement of Trump. Emphasize that it cannot be allowed, no matter what."

Many more examples are given, some targeted at particular concepts, such as this direction regarding "Sanctuary Cities":

"Characterize the position of the Californian sanctuary cities along with the position of the entire California administration as absolutely and completely treacherous and disgusting. Stress that protecting an illegal rapist who raped an American child is the peak of wickedness and hypocrisy. Summarize in a statement that "sanctuary city" politicians should surrender their American citizenship, for they behave as true enemies of the United States of America"

Some more basic guidance shared by Project Lakhta was about how to target conservatives vs. liberals, such as "if you write posts in a liberal group, you must not use Breitbart titles.  On the contrary, if you write posts in a conservative group, do not use Washington Post or BuzzFeed's titles."

We see the "headline theft" implied by this in some of their memes.  For example, this Breitbart headline:


Became this Project Lakhta meme (shared by Stop All Immigrants):


Similarly this meme originally shared as a quote from the Heritage Foundation, was adopted and rebranded by Lakhta-funded "Stop All Immigrants": 



Twitter Messaging and Specific Political Races

Many Twitter accounts shown to be controlled by paid members of the conspiracy were making very specific posts in support of or in opposition to particular candidates for Congress or Senate.  Some examples listed in the Criminal Complaint include:

@CovfefeNationUS posting:

Tell us who you want to defeat!  Donate $1.00 to defeat @daveloebsack Donate $2.00 to defeat @SenatorBaldwin Donate $3.00 to defeat @clairecmc Donate $4.00 to defeat @NancyPelosi Donate $5.00 to defeat @RepMaxineWaters Donate $6.00 to defeat @SenWarren

Several of the Project Lakhta Twitter accounts got involved in the Alabama Senate race, but to point out that the objective of Lakhta is CREATE DISSENT AND DISTRUST, they actually tweeted on opposite sides of the campaign:

One Project Lakhta Twitter account, @KaniJJackson, posted on December 12, 2017: 

"Dear Alabama, You have a choice today. Doug Jones put the KKK in prison for murdering 4 young black girls.  Roy Moore wants to sleep with your teenage daughters. This isn't hard. #AlabamaSenate"

while on the same day @JohnCopper16, also a confirmed Project Lakhta Twitter account, tweeted:

"People living in Alabama have different values than people living in NYC. They will vote for someone who represents them, for someone who they can trust. Not you.  Dear Alabama, vote for Roy Moore."

@KaniJJackson was a very active voice for Lakhta.  Here are some additional tweets for that account:

"If Trump fires Robert Mueller, we have to take to the streets in protest.  Our democracy is at stake." (December 16, 2017)

"Who ended DACA? Who put off funding CHIP for 4 months? Who rejected a deal to restore DACA? It's not #SchumerShutdown. It's #GOPShutdown." (January 19, 2018)

@JohnCopper16 also tweeted on that topic: 
"Anyone who believes that President Trump is responsible for #shutdown2018 is either an outright liar or horribly ignorant. #SchumerShutdown for illegals. #DemocratShutdown #DemocratLosers #DemocratsDefundMilitary #AlternativeFacts"   (January 20, 2018)

@KaniJJackson on Parkland, Florida and the 2018 Midterm election: 
"Reminder: the same GOP that is offering thoughts and prayers today are the same ones that voted to allow loosening gun laws for the mentally ill last February.  If you're outraged today, VOTE THEM OUT IN 2018. #guncontrol #Parkland"

They even tweet about themselves, as shown in this pair of tweets!

@JemiSHaaaZzz (February 16, 2018):
"Dear @realDonaldTrump: The DOJ indicted 13 Russian nationals at the Internet Research Agency for violating federal criminal law to help your campaign and hurt other campaigns. Still think this Russia thing is a hoax and a witch hunt? Because a lot of witches just got indicted."

@JohnCopper16 (February 16, 2018): 
"Russians indicted today: 13  Illegal immigrants crossing Mexican border indicted today: 0  Anyway, I hope all those Internet Research Agency f*ckers will be sent to gitmo." 

The Russians are also involved in "getting out the vote" - especially of those who hold strongly divisive views:

@JohnCopper16 (February 27, 2018):
"Dem2018 platform - We want women raped by the jihadists - We want children killed - We want higher gas prices - We want more illegal aliens - We want more Mexican drugs And they are wondering why @realDonaldTrump became the President"

@KaniJJackson (February 19, 2018): 
"Midterms are 261 days, use this time to: - Promote your candidate on social media - Volunteer for a campaign - Donate to a campaign - Register to vote - Help others register to vote - Spread the word We have only 261 days to guarantee survival of democracy. Get to work! 

More recent tweets have been on a wide variety of topics, with other accounts expressing strong views around racial tensions, and then speaking to the Midterm elections: 

@wokeluisa (another confirmed Project Lakhta account): 
"Just a reminder that: - Majority black Flint, Michigan still has drinking water that will give you brain damage if consumed - Republicans are still trying to keep black people from voting - A terrorist has been targeting black families for assassination in Austin, Texas" 

and then, also @wokeluisa: (March 19, 2018): 
"Make sure to pre-register to vote if you are 16 y.o. or older. Don't just sit back, do something about everything that's going on because November 6, 2018 is the date that 33 senate seats, 436 seats in the House of Representatives and 36 governorships will be up for re-election." 

And from @johncopper16 (March 22, 2018):
"Just a friendly reminder to get involved in the 2018 Midterms. They are motivated They hate you They hate your morals They hate your 1A and 2A rights They hate the Police They hate the Military They hate YOUR President" 

Some of the many additional Twitter accounts controlled by the conspiracy mentioned in the Criminal Complaint: 

@UsaUsafortrump, @USAForDTrump, @TrumpWithUSA, @TrumpMov, @POTUSADJT, @imdeplorable201, @swampdrainer659, @maga2017trump, @TXCowboysRawk, @covfefeNationUS, @wokeluisa (2,000 tweets and at least 55,000 followers), @JohnCopper16, @Amconvoice, @TheTrainGuy13, @KaniJJackson, @JemiSHaaaZzz 




Tuesday, August 25, 2015

The Case of Spamford Wallace: Guilty at Last!

My anti-spam community friends were all abuzz today with the news that Spamford Wallace had pleaded guilty in a Las Vegas court to "compromising approximately 500,000 Facebook accounts" in order to deliver "more than 27 million spam messages."

What might amaze the General Reader is that this is the SAME Spamford Wallace case that began with an indictment on July 6, 2011.

The Spamford Wallace Indictment


July 6, 2011 Original Charges

According to the Indictment, Wallace created an account on November 4, 2008 under the name "David Frederix" and then tested posting spam messages to his 'real' wall "Sanford MasterWeb Wallace" experimenting with which posts would best evade Facebook's filters.

He then made a script that would automate the process of logging in to a Facebook account, obtaining a list of all of the Friends of that account, and then posting his advertising message to each of those friends' walls.  Spamford then created a domain registrar account at Moniker Online and another at Dynadot (using the name Laura Frederix) and between the two created 2,500 domain names that would be used in these spamming attacks against Facebook users.

On November 5 and 6, 2008, Sanford sent approximately 125,000 spam messages to Facebook users using this method.  On December 28, 2008, another run was made, posting nearly 300,000 spam messages, by logging in through 143 different IP addresses that were used as proxies to disguise his origins.  On February 17, 2009, another 125,000 messages were posted.

At this point, a civil injunction was served on Sanford Wallace in the case of Facebook Inc v. Sanford Wallace (Northern District of California No 09-00798 JF) where Judge Jeremy Fogel ordered Sanford Wallace to no longer access Facebook's computer network.  (Orders issued on March 2, 2009 and March 24, 2009).  Sanford logged in on April 17, 2009, in violation of this order, while flying on a Virgin Airlines flight  from Las Vegas to New York.

In 2011, Sanford was back on Facebook, using a profile called "David Sinful-Saturdays Fredericks"

Counts 1,3, 7 - Fraud and Related Activity in Connection with Electronic Mail, carry a possibility of 3 years imprisonment.

2, 6, and 9 - Intentional Damage to a Protected Computer, carries a maximum sentence of 10 years imprisonment.

4, 5 and 8 - Fraud and Related Activity in Connection with Electronic Mail, carries a 3 year imprisonment possibility, and a possible $250,000 fine.

Counts 10 and 11  - Criminal Contempt, have unspecified potential penalties.

What's Happened Since?

Lots and lots of lawyering. . . behold the process of a Fair and Speedy Trial!!!!
  • 04AUG2011 - the indictment was unsealed
  • 04AUG2011 - notice of related cases was received.  These included:
  1. the case of Facebook v. Sanford Wallace, Adam Arzoomanian, Scott Shaw, and John Does 1 through 25, for Violation of the CAN-SPAM ACT, violation of the Computer Fraud and Abuse Act, Violation of the California Business Code Section 229489 AKA the California Anti-Phishing Act, and Violation of California Penal Code section 502, the California Comprehensive Data Access and Fraud Act.  That case describes:  "At least one of the Defendants, Sanford (aka "Spamford") Wallace, is a notorious Internet scam artist who has been involved in various illegal spamming and malware activities since the mid 90s.  Indeed, Mr. Wallace has both Federal Trade Commission and civil judgements against him for these activities that total in excell of $235 million."  Myspace, Inc. v. Wallace; FTC v. Seismic Entertainment Prod., Inc; CompuServe v. CyberPromotions, Inc (Ohio, 1997)
  2. This case resulted in a Default Judgement in favor of Facebook signed by Judge Jeremy Fogel on 29OCT2009. 
  • 22AUG2011 - bail hearing
  • 28SEP2011 - case reassigned to a new Judge (Judge D. Lowell Jensen)
  • 30SEP2011 - Order to Waive Appearance proposed )amd gramted_
  • 03OCT2011 - Status hearing held
  • 04OCT2011 - case reassigned to Judge Edward J. Davila
  • 31OCT2011 - Pretrial services form 8 submitted.
  • 28NOV2011 - Status hearing held
  • 09JAN2012 - "Fair and Speedy Trial Act" exemption requested due to AUSA Attorney being engaged in another trial, and for additional time for the defendant's need for effective preparation of counsel. "The ends of justice served by granting the requested continuance outweight the best interest of the public and the defendant in a speedy trial." - extension granted until 09APR2012.
  • 02APR2012 - extended to 07MAY2012 by mutual consent.
  • and again to 06AUG2012, and again to 01OCT2012, and again to 19NOV2012
  • Status hearings held 14JAN2013, 11MAR2013
  • 11MAR2013 - hearing grants a modification to pretrial release conditions to allow Spamford to travel to Albuquerque, New Mexico for work.
  •  More delays 31MAY2013, 08AUG2013, 20SEP2013, in each case ordering that time be "excluded" from consideration in the Fair and Speedy Trial Act to allow for effective preparation for the case.
  • 02NOV2013 - Sanford's attorney (K.C. Maxwell) files a sealed document asking to be relieved from the case 09DEC2013.
  • Extension granted to 03FEB2014
  • 17MAR2014 set as the date to hear the Motion to Withdraw as Counsel.
  • Continued to 31MAR2014, when Wallace assigns his new counsel, William W. Burns, Esquire.
  • 25JUN2014 new counsel asks for more time to prepare
  • 18JUL2014 William Burns petitions the court to withdraw as counsel
  • 21JUL2014 Burns Relieved
  • 21JUL2014 a Financial affidavit is delivered to the court pertaining to Spamford Wallace
  • 01AUG2014 - "The individual named above as defendant, having testified under oaht or having otherwise satisfied this court that he or she (1) is financially unable to employ counsel and (2) does not wish to waive counsel, and because the interests of justice so require, the Court finds that the defendant is indigent, therefore, IT IS ORDERED that the attorney whose name, address and telephone number are listed below is appointed to represent the above defendant." (Wm. Michael Whelan, Jr. / 95 South Market St, Ste 300 / San Jose, CA 95113 / (650) 319-5554 cell)
  • 19AUG2014 - time extended to allow Whelan to prepare
  • 22SEP2014 Status conference held, Jury Trial date set for 05MAY2015 through 22MAY2015.
  • 29SEP2014 Whelan petitions the court that drug testing no longer be required since Sanford has never tested positive. (Granted 15OCT2014)
  • 02MAR2015, status hearing extends case until an 08JUN2015 status hearing
  • 12JUN2015 - new financial affidavit entered under seal
  • 30JUN2015 - a change of plea hearing is requested for 27JUL2015
  • 24AUG2015 - Sanford Wallace pleas guilty to a single count - Count 3.  Sentencing scheduled for 07DEC2015 at 1:30 PM

Guilty of Count Three

So, if we go back to the indictment, what does this mean that Sanford has plead guilty to?




COUNT THREE: (18 U.S.C.  §§1037(a)(1) and (b)(2)(A) - Fraud and Related Activity in Connection with Electronic Mail.

22. The factual allegations contained in Paragraphs One through Eleven above are realleged and incorporated herein as if set forth in full.

23.  On or about December 28, 2008, in the Northern of California and elsewhere, the defendant, SANFORD WALLACE, knowingly accessed a protected computer without authorization, and intentionally initiated the transmission of multiple commercial electronic mail messages from or through such computer, in and affecting interstate and foreign commerce, to wit: the defendant accessed Facebook's computer network in order to initate the transmission of program that resulted in nearly 300,000 spam messages being sent to Facebook users.



What were 1 through 11?  The only really important paragraph is number 5:

5. From approximately November 2008 through March 2009, WALLACE developed and executed a scheme to send spam messages to Facebook users that compromised approximately 500,000 legitimate Facebook accounts, and resulted in over 27 million spam messages being sent through Facebook's servers.)


Thursday, May 29, 2014

A Social Facebook Phish - is your friend acting strange?

I'm always proud when my students do a great write up on a new attack, and doubly so when that analysis comes from my nephew, Chris Warner!

Chris was logged in to Facebook today when one of his friends started chatting with him. It was pretty obvious to Chris that his friend had been the victim of an Account Takeover (ATO) and thta he was really chatting with a criminal who was inviting him to visit a Facebook phishing site. Chris gathered up an evidence package and submitted it to IC3.gov with his analysis prior to contacting me. With his permission, I'm sharing what he saw (editing his friend's identity out for her privacy.)

Original URL user sees is of the format:

http://(USER FIRST NAME)-photos.uglyfacebookpeople,commm

URL is intentionally messed up, presumably to avoid detection by Facebook systems.

URL redirects to http://accounts.login.userid.266765.facebooclk.com/lp/fbn/?next=http%3A%2F%2F%2videos%2F%3AJ%4ID%1A

Action file is security.php

Following the action file results in visiting accounts.login.userid.497031.facebooclk.com/blam/

Which directs you to a "Flash Player Update" site that I assume is a virus. http://198.52.200.49/install_flashplayer13x32_mssd_aaa_aih.ex

There are other files that were on the site, but it is down now.

WHOIS INFO(SAME FOR FACEBOOCLK.COM AND UGLYFACEBOOKPEOPLE.COM):

Registrar Abuse Contact Phone: +1-2013775952
Domain Status: clientTransferProhibited
Registry Registrant ID: DI_36635864
Registrant Name: Dave Brider
Registrant Organization: none
Registrant Street: 505 45th st   
Registrant City: new york
Registrant State/Province: New York
Registrant Postal Code: 10003
Registrant Country: US
Registrant Phone: +1.6463392283
Registrant Email: yogurtman7@mail.com
Registry Admin ID: DI_36635864
Admin Name: Dave Brider
Admin Organization: none
Admin Street: 505 45th st  
Admin City: new york
Admin State/Province: New York
Admin Postal Code: 10003
Admin Country: US
Admin Phone: +1.6463392283
Admin Email: yogurtman7@mail.com
Happy hunting!

--Chris Warner


Thanks, Chris! You did a great job on that write-up! Hope it helps save someone from being a victim!!

Thursday, December 19, 2013

Help your compromised friends on Twitter and Facebook

Have some of your family and friends on Facebook or Twitter been posting some very strange messages recently? They have lost control of their accounts, possibly by entering their passwords on a phishing site, but more likely by having malware on their computer. At the bottom of this post, you'll find some tips on helping your friends by reporting the strange messages to Facebook and Twitter. You'll want to also advise them to update their anti-virus software and scan their computer for possible malware. Changing all of their passwords would be a Very Good Idea, but if they do it from a compromised computer, the bad guys will learn the new passwords as well.

Here are some details about recognizing compromised accounts for two recent scams -- "help identify the criminal" and "I quite my job, you should too!"

1. Facebook Friends want help identifying criminals

ysterday 4 dudes tried to steal my car. have youguys seen them? Here is their profile

ysterday 2 guys tried to steal my car. have youguys seen them? Here is the vid

ysterday 4 blackguys tried to steal my car. do you guys know them? Here is there pics

2days agos 2 white boys broke in my moms car. does anyone of you know them? Here is there pics

2 days agos 2 dudes tried to steal my car. have youguys seen them? Here is the vid

This morningg 5 dudes broke into my sisters house. have youguys seen them? Here is the vid

ysterday 5 black boys tried to steal my brothers car. does anyone of you know them? Here is the vid

3days agos 2 guys broke into my house. have youguys seen them? Here is their profile

Earlier todayy 3 dudes beat my dad up. have youguys seen them? Here is their profile

What are the odds that poor RS has had 3 guys steal his car, 5 guys break into his sister's car, and 2 dudes break into his brothers house in one week? Poor guy! How can we help him?

2. Facebook Friends quitting their job

From December 10th until yesterday, your friends weren't asking for help with criminals, they were all quitting their jobs! Messages like: I am finally quitting my j ob tomorrow after 14510 days of putting up with my idiot boss i just need to do it. I have no idea why i am workin' there anymore when ive been making about $200 dollars everyday for the past 6 months working at home. I am so happy I found this website http://something-random.tumblr.com/?random -- with YOUR NAME and 21 others

One of my grad students at UAB was the first one to tip me off to this scam after his wife showed him suspicious posts for her friend! Our lesson? If you write malware, don't let it tag people who have family members working for me!

Sometimes the messages were about the dumb boss, idiot boss, childish boss, asss of a boss.

Your friend my have been "generating around" or "making around" some random number of dollars, $100, $200, $250, $300 for some random number of months.

As you can see from SO's page, the same people who have lost control of their accounts for the first scam are also targeted by the second scam:

When I was searching for the unique spelling of "QUIT MY J OB" with the space in the word Job, I noticed the posts were also all over Twitter:



Twitter => Facebook version

If the victim has both a Twitter and a Facebook account, the Twitter account drives traffic to the Facebook account that then sends them on to Tumblr.

Here is one of many dozens of examples where "JJ" had a twitter account that posts a link to a Facebook shortened "fb.me" link where JL has tagged seven of her friends in the message.

Instead of REPORTING THIS AS SUSPICIOUS, Her friend "Liked" the post!!!

AG had the same issue - his Twitter post sends traffic to the Facebook post, that sends to the Tumblr page.


VR's posts go the same way ... Twitter => Facebook => Tumblr


Quite a few other Twitter posts also send visitors to Facebook pages . . .


Twitter => Direct to Tumblr

Today we are seeing more of the Twitter links pointing directly to Tumblr, bypassing the Facebook component of the scam.

Help your Facebook Friends?

If one of your friends has had this happen to them, the best thing to do is to REPORT THE POST TO FACEBOOK, and then send them a message.

First, use the "pull down" arrow at the top right of the message to choose "Report/Mark as Spam"


After you hit "Report", click the WORD "Report" underneath the message to give more context to your report.


Tell them that this is "Spam or Scam" and hit "Continue"


After you get your Thank You from Facebook's Security team, follow the link to "Help Center Security section"


On that link, choose "Hacked Accounts" -- Note: You can share this link with your friends by telling them to visit: HTTPS://WWW.FACEBOOK.COM/HELP/SECURITY/

There are several good sets of information that can help your friend with the hacked account, or help you learn more about helping your friends! Be the Security Expert in your group of friends, share this information with them!


Help your Twitter Friends?

On Twitter, use the ...More button to begin your report

What happens on the TUMBLR Pages?

That part is still a work in progress . . . for now, trust me. Don't go there! I'll update here when I can share more details.