Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Social Media
Facebook Removes Hundreds of Fake AccountsMajority of Phony Postings Originated in Ukraine and Iraq
Facebook announced this week that it has removed hundreds of fake user accounts and pages after an investigation determined they were used to spread misinformation about local politics and events.
See Also: Live Webinar | Breaking Down Security Challenges so Your Day Doesn’t Start at 3pm
Facebook reports that the majority of these fake pages and accounts originated in Iraq or Ukraine; those from Ukraine were linked to a public relations agency that spent about $1.6 million on advertising with Facebook as well as Instagram.
A total of 244 accounts, 269 pages and 80 groups were removed from the Facebook platform, along with seven pages from Instagram, which the company owns. Facebook identified fake accounts – those that fraudulently use the identity of individuals - that spread politically inclined messages to social media users in Iraq and Ukraine, says Nathaniel Gleicher, the head of head of cybersecurity policy at Facebook.
The suspended accounts and pages exhibited "coordinated inauthentic behavior" and misled other users through fake profiles, Gleicher says. Facebook clarified that the accounts in the two countries were part of separate campaigns.
This type of coordinated behavior usually comes ahead of elections, Facebook says. Ukraine held a presidential election in July. But Iraq’s last parliamentary election was in May 2018.
Facebook has found that these types of coordinated efforts are used to spread phishing emails and other scams across the company's social media platforms. In these new cases, Facebook estimates less than 1.6 million of its users followed one or more of the fake pages from Iraq, while less than 4.2 million followed the phony Ukraine pages.
Napoleoncat, a social media marketing company based in Poland, estimates Facebook has about 17 million users in Iraq and 12 million in Ukraine.
Focus on Regional Politics
In Iraq, Facebook suspended 168 accounts, 149 pages and 79 groups. In Ukraine, the company removed 76 accounts, 120 pages, one group, two events and seven Instagram accounts for engaging in what the company calls "domestic-focused coordinated inauthentic behavior."
While Facebook has not yet reveal the identity of actors behind the fake accounts in Iraq, the company linked the social media activities in Ukraine to Pragmatico, a public relations firm.
In Iraq, Facebook says the page admins and account users largely posted social and political content that focused on Saddam Hussein, the former Iraqi president who was executed in 2006.
"The page admins and account owners typically posted about domestic political and societal issues such as religion, various public figures including Saddam Hussein, the state of the military under the Saddam rule, tensions with Iran, the U.S. military action in Iraq, Iranian-backed militia operating in Iraq and Kurdish-Iraqi politic," Facebook reports.
In contrast, in Ukraine, the fake pages focused on celebrities, show business, sports, the local elections, political candidates and criticism of various public figures.
For some time now, Facebook and other social media companies, such as Twitter and YouTube, have been attempting to remove fake content. For instance, Facebook announced that it removed several fake accounts ahead of the U.S midterm elections in November 2018. More recently, Facebook and Twitter removed several accounts tied to the Chinese government during pro-democracy protests in Hong Kong, according to published reports.
Although some security experts believe that Facebook is taking the right steps to clear its platforms of fake accounts, they say that the social media giant needs to do much more.
"From the ability to run effective open source intelligence campaigns to being able to bring up fake accounts … social media can be used to target certain employees, groups or individuals effectively," Chris Roberts, the chief security strategist at Attivo Networks, which offers deception technologies, tells Information Security Media Group. "All of this happens outside of a company’s perimeter, making any protection or detection that much harder."
Roberts adds that understanding human behaviors, adversarial patterns and tactics could help social media companies thwart these abuses.
"As the learning mechanisms evolve, including the understanding of human behaviors, adversarial patterns, tactics and approaches, so too should the technology that is being used to track them. We need to be able to draw level with what the adversaries are doing," Roberts says.