AGORACOM Small-cap Investor Relations Blog

SPONSOR: Datametrex AI Limited (TSX-V: DM) A revenue generating small cap A.I. company that NATO and Canadian Defence are using to fight fake news & social media threats. The company announced three $1M contacts in Q3-2019. Click here for more info.

Disinformation in 5.4 Billion Fake Accounts: A Lesson for the Private Sector

• Social media platforms are turning a new leaf to make online communities safer and happier places. Instagram turned off “likes,” but the biggest news came when Facebook shut down 5.4 billion fake accounts.

By: John Briar

Social media platforms are turning a new leaf to make online communities safer and happier places. Instagram turned off “likes,” but the biggest news came when Facebook shut down 5.4 billion fake accounts. The company reported that up to five percent of its monthly user base of nearly 2.5 billion consisted of fake accounts. They also noted that while the numbers are high, that doesn’t mean there is an equal amount of harmful information. They are just getting better at identifying the accounts.

The concerted effort to close fictitious accounts is shedding light on disinformation and misinformation campaigns. But it’s not a new tactic. It dates back to the early days of war when false content was spread with the intent to deceive, mislead, or manipulate a target or opponent. Where disinformation was once communicated by telegram, the modern version of vast, coordinated campaigns are now disseminated through social media with bots, Twitterbots and bot farms—at a scale humans could never perform.

Now, disinformation campaigns can be lodged by a government to influence stock prices in another country, or by a private company to degrade brand presence and consumer confidence. What’s worse is that bots can facilitate these campaigns en masse.

Understanding the Role Bots Play in Disinformation

On social media, you might be able to easily identify bots trolling users. Or maybe not—it’s often trickier than you’d expect. Sophisticated bots use several tactics that make them successful at disinformation and appearing human, including:

1. Speed and Amplification – Bots quickly spread low-credibility content to increase the likelihood information goes viral. The more humans see the disinformation campaigns, the more likely they are to spread it themselves.
2. Exploiting Human-Generated Content – Bots spread negative or polarizing content generated from real humans that prove to be credible to other humans.
3. Using Metadata – Bots used more metadata (comments, photo captions, etc.) to appear as human, which helps evade detection.

Whether fraudsters create false information or use existing misinformation, bots are the unstoppable force in the spread of disinformation. Even with platforms like Facebook dismantling campaigns, taking down bots is a pervasive game of whack-a-mole.

Business Interference: A Bot’s Expertise

How do we take the lessons learned and apply them to today’s businesses? For one thing, we know that identifying bots masquerading as customers, competitors, or the actual company is increasingly difficult.

Some attempts to deceive, mislead and manipulate customers use the same bot-driven propaganda techniques as we have seen on social media platforms. Bots can amplify and create negative reviews, spread misinformation about unrest in a company, or defame company leadership.

Beyond that, one of the biggest threats to businesses is content scraping. In this attack vector, bots are programmed to crawl and fetch any information that could be used “as is” or injected with misinformation before spreading. This could include prices, promotions, API data, articles, research and other pertinent information. Because of the open nature of the Internet, nothing is stopping bots from gaining access to websites and applications, unless bot detection and mitigation is in place.

Aside from what we have seen, what do company-targeted disinformation campaigns look like in the wild?

• Legitimate pricing sheets could be scraped by a bot, then distorted to become favorable to the competition before presenting to prospects.
• Articles are stolen, injected with misinformation and copied around the Internet—hurting businesses twofold—search engines assuming the company is trying to game SEO and lowering the ranking, and misleading content consumers.

Given that bots account for nearly half of web traffic, standard cybersecurity technologies that do not specialize in bots cannot prevent the onslaught of fraudulent traffic. If information reserved for customers and partners exists on company websites, even behind a portal, companies should expect bots to continue scraping their sites until they leave with valuable content. From all the data that has been studied, bad bots come early – days after a site is launched. They attack in waves, consistently trying and retrying to capture critical information.

The Future of Bots in 2020

If the headlines teach us anything, we can predict that 2020 will bring even more sophisticated bots in full force, leveraging artificial intelligence (AI) and getting smarter about how to behave like a human. To outpace fraudsters and their bot armies, the same advanced technologies like AI and machine learning along with behavioral analytics are required. Only then will it be possible to parse out traffic and allow humans through, while stopping bots before they can gather information for disinformation campaigns.

Source: https://www.securitymagazine.com/articles/91616-disinformation-in-54-billion-fake-accounts-a-lesson-for-the-private-sector

SPONSOR: Datametrex AI Limited (TSX-V: DM) A revenue generating small cap A.I. company that NATO and Canadian Defence are using to fight fake news & social media threats. The company announced three $1M contacts in Q3-2019. Click here for more info.

Data Privacy Day 2020: 5 Lessons From The Past To Better Secure The Future

(By David Higgins)

• Lawmakers claim Facebook “contravened the law by failing to safeguard people’s information” – and suffered the consequences.
• Now the US government is placing additional pressure on Facebook to stop the spread of fake news, foreign interference in elections and hate speech (or risk additional, larger fines)
• This Data Privacy Day urges individuals and organisations around the world to learn from the fallout of the mega-breaches of the recent past.

Until recently, data privacy was only considered critical in the digital world. But as the digital and physical worlds intersect, it is now integral not only to securing an individual or a corporation’s digital identity, but also to avoiding the safety of citizens being compromised. Data privacy considerations should underpin all company decisions, whether on the board level or on the shop floor and, this Data Privacy Day, organisations should encourage their entire workforce – not just IT teams – to re-evaluate how they secure and manage data.

It’s now well-established that data is the world’s most valuable asset, and a tempting target for malevolent hackers with varying motivations. More often than not, they are pursuing credentials that they can use to infiltrate businesses and target sensitive and valuable data. Attackers seek ways to cause irreparable damage across a whole range of industries, from seizing companies’ administration logins to hacking into medical data so as to hold individuals to ransom over the disclosure of sensitive personal information. As a tragic, but potentially realistic scenario, this could even result in a doctor being unable to perform a life-saving operation due to a lack of availability of the patient’s records for example.

Hackers will inevitably be successful from time to time. Addressing this threat and limiting how far they can infiltrate a network after a successful breach is imperative in order to safeguard national security. Infiltration or compromise of CNI, for instance, could plausibly result in the loss of control of public services such as utilities, healthcare and government, posing a severe risk to public safety. This Data Privacy Day, we need to take a step back to not only understand the value in the data we hold, but also the importance of only allowing individuals and systems that need it to access it.

Mega Breach lesson #1: Equifax Breach (reported in 2017) – Several tech failures in tandem–including a misconfigured device scanning encrypted traffic, and an automatic scan that failed to identify a vulnerable version of Apache Struts–ultimately led to the breach which impacted 145M customers in the US and 10M UK citizens.

Data Privacy Day Learning – get security basics right. Cyberattacks are growing more targeted and damaging but a good industry reminder from the Equifax breach is that standard security basics should never be ignored. Patches should be applied promptly, security certificates should be maintained, and so on. This breach also inspired elected officials to push for stronger legislation to tighten regulations on required protection for consumer data.

Mega Breach lesson #2: Uber Breach (reported in 2017) – In 2017 Uber revealed it had suffered a year-old breach that exposed personal information belonging to 57M drivers and customers.

Data Privacy Day Learning – don’t store code in a publicly accessible database. Uber data was exposed because the AWS access keys were embedded in code that was stored in an enterprise code repository by a third party contractor. A clear takeaway is that no code repository is a safe storage place for credentials.

Mega Breach lesson #3: Facebook’s Cambridge Analytica Breach (reported in 2018) – Cambridge Analytica harvested the personal data of millions of peoples’ Facebook profiles without their consent and used it for political advertising purposes. The scandal finally erupted in March 2018 with the emergence of a whistle-blower and Facebook was fined £500,000 ($663,000), which was the maximum fine allowed at the time of the breach.

Data Privacy Day Learning – protect user data (or pay up). Lawmakers claim Facebook “contravened the law by failing to safeguard people’s information” – and suffered the consequences. Now the US government is placing additional pressure on Facebook to stop the spread of fake news, foreign interference in elections and hate speech (or risk additional, larger fines).

Mega Breach lesson #4: Ecuadorian Breach (reported in 2019) – Data on approximately 17M Ecuadorian citizens, including 6.7M children, was breached due to a vulnerability on an unsecured AWS Elasticsearch server where Ecuador stores some of its data. A similar Elasticsearch server exposed the voter records of approximately 14.3 million people in Chile, around 80% of its population.

Data Privacy Day Learning – adhere to the shared responsibility model. Most cloud providers operate under a shared responsibility model, where the provider handles security up to a point and, beyond that, it becomes the responsibility of those using the service. As more and more government agencies look to the cloud to help them become more agile and better serve their citizens, it’s vital they continue to evolve their cloud security strategies to proactively protect against emerging threats – and reinforce trust among the citizens who rely on their services.

Mega Breach lesson #5: Desjardins Breach (reported in 2019) — The data breach that leaked info on 2.9M members wasn’t the result of an outside cyber attacker, but a malicious insider – someone within the company’s IT department who decided to go rogue and steal protected personal information from his employer.

Data Privacy Day Learning – be proactive in identifying unusual/unauthorized behaviour. While insider threats can be more difficult to identify, especially in a case where the user had privileged access rights, having a solution in place to monitor for unusual and unauthorized activities that can take automated remediation steps as needed can help reduce the amount of time it takes to stop an attack and minimize data exposure. This breach shows that a defence in depth security strategy that includes privileged access security, multi factor authentication, and the detection of anomalous behaviour with tools such as database activity monitoring has never been more crucial.

Source: https://www.expresscomputer.in/news/data-privacy-day-2020-5-lessons-from-the-past-to-better-secure-the-future/45933/