Enterprise Safety
How sporting a ‘sock puppet’ can assist the gathering of open supply intelligence whereas insulating the ‘puppeteer’ from dangers
11 Jan 2024
•
,
4 min. learn
Within the untold expanse of on-line data and communication, the power to seek out the sign within the noise and discern the authenticity of information and its sources turns into more and more crucial.
We’ve beforehand seemed on the mechanics of open supply intelligence (OSINT), the follow of gathering and analyzing publicly out there data for investigative functions, and particularly how cyber-defenders can use it to remain a step forward of attackers.
On this article, we’ll give attention to a device generally utilized in OSINT: so-called sock puppet accounts, how they’re created and used, together with the dangers that their use might entail.
What are sock puppets?
Put merely, sock puppet accounts are fictitious identities that present their masters with anonymity whereas utilizing social media platforms, dialogue boards, electronic mail and different on-line companies. They are often harnessed for OSINT investigations so as to assess rising cyberthreats, collect data on on-line fraud, abuse and different illicit actions and gather proof of such wrongdoing, monitor extremist ideologies or acquire different insights into particular tendencies or points.
The data collected by these analysis accounts usually goes deeper than the readily disclosed data and should require establishing relationships with different folks. The entities that leverage these accounts run the gamut and vary from regulation enforcement, non-public investigators and journalists to intelligence analysts, community defenders and different safety practitioners, together with for efforts aimed toward detecting and mitigating potential threats.
However, these faux personas may also be deployed to do the bidding of malicious actors, who might use sock puppets to assist unfold spam or extract data from or in any other case manipulate their targets. These accounts are additionally usually utilized in disinformation efforts to assist steer discussions in a specific route, amplify false narratives, form public discourse and in the end sway opinions a couple of broader societal subject or a corporation.
Sock puppets in OSINT
Sock puppet accounts allow OSINT practitioners to mix into on-line communities and collect data with out revealing their true id and with out concern of reprisal, particularly the place their private security might be jeopardized. They will present their “puppeteers” with entry to closed or non-public teams that might in any other case be inaccessible to exterior observers.
Creating sock puppets requires a good quantity of strategic planning that considers variables equivalent to the selection of platforms which might be residence to the best quantity of data on targets all the way in which to pondering by after which working towards correct operational safety measures.
In an effort to keep away from disclosing their proprietor’s true IP deal with and for different operational safety causes, these accounts are sometimes utilized in tandem with instruments equivalent to digital non-public networks (VPNs), Tor (particularly when accessing the darkish net) and proxy companies or, the place their use will not be permitted, a public Wi-Fi connection.
When establishing and managing sock puppet accounts, a burner cell phone can also be vital. The identical goes for devoted password administration instruments like KeePass and useful instruments equivalent to Firefox Multi Account containers that separates every of the investigator’s digital lives.
Clearly not all sock puppets are made alike. Leaving apart short-term ad-hoc accounts, that are discarded as soon as their job (equivalent to registering on a web site or sending an electronic mail) is accomplished, maybe the commonest and attention-grabbing use case is social media accounts, and people require much more effort.
This begins with the creation of an electronic mail account that can not be traced again to its proprietor after which a practical id with detailed (although, after all, fictitious) private data. It’s simply as essential to craft a reputable backstory and use a constant voice and tone that’s additional supported by sustained exercise over time within the type of feedback, posts and photographs. A plan that lays out the account’s actions – equivalent to figuring out and visiting different accounts, posting feedback, and sustaining a practical persona total – helps keep away from setting off alarm bells.
Figuring out potential sock puppets
Sock puppet accounts may be noticed by:
- behavioral sample evaluation: sock puppets might observe related behavioral patterns, equivalent to reposting the identical messages or utilizing repetitive language, or displaying an absence of interactions with actual customers or little to no engagement as such.
- inspecting profile particulars: for instance, an absence of detailed private data and the usage of inventory pictures are clear giveaways.
- cross-checking and verification: evaluating data offered by sock puppets with different sources, which helps validate collected information.
Sock puppets in motion
Sock puppets play a pivotal function in OSINT, offering its practitioners with a strong device for gathering data whereas sustaining their anonymity. Nonetheless, understanding the related threats and potential pitfalls can be important for conducting efficient and moral investigations. For starters, investigators have to keep away from the chance of discovery and be nicely versed in figuring out sock puppet accounts which may be used for counterintelligence functions.
Importantly, the usage of sock puppet accounts additionally entails moral concerns and potential authorized dangers or restrictions, and it must align with the supposed targets and keep away from inflicting unintended hurt. The ‘puppeteers’ must also rigorously weigh the advantages and downsides of those personas and make sure that their use aligns with moral requirements, authorized necessities, and the general goals of accountable data gathering.
