Sunday, March 22, 2015

The Ayatollah's Spam Bots

I noticed a few hours ago a rash of spam bots on Twitter promoting Ayatollah Khamenei's letter 'To the Youth in Europe and North America' while searching for something which would seem to be completely unrelated. The bots appear to be using the reasonable hashtags #Letter4u and #LetterForAll in every tweet along with a mixture of completely irrelevant (and nonsensical) ones such as #CNN, #Canada and #StandWithIsrael, and a photo with a quote from Khamenei. In every tweet there is a shortened link which redirects to Khamenei's website and the letter.



The bots seem to be on some sort of cycle where accounts post a pattern of tweets in a particular order.


There are hundreds if not thousands of accounts, most of them with over 10000 tweets. Twitter has a limit of 1000 tweets per day, and the accounts seem to have been created with this in mind.

Many of the accounts use fake photos taken from a variety of places. Some of them show celebrities, while others journalists or other media personalities.



.@AndrewWrites thought you should be aware of this: someone using your photo and spreading pro-#Iran govt propaganda pic.twitter.com/2BXUdBZSR5
— Morgan Carlston (@MorganCarlston) March 22, 2015




As far as I can tell, the bots started around 10 days ago and have continued tweeting incessantly. The timing makes me think that this is in response to the letter from the 47 GOP senators, but as Holly Dagres noted in early February of this year, something similar happened on Instagram with spammed photos and quotes and hashtags. Perhaps it is just a coincidence, but I believe there is a connection to the letter.


UPDATE #1: Some of the hashtags used by the spam bots (in addition to #Letter4u and #Letter4all). From my count that is 67 hashtags co-opted by the spam bots (not counting the 2 'letter' ones). They appear to repeat every hour or so on a loop.






































UPDATE #2:
Quite a few of the accounts sending the spam have been suspended! I've been on a mission tweeting to people whose photos were used by the attackers, and it looks like at least quite a few of the fake accounts are suspended. Twitter searches for "Iron Dome" and "Stand With Israel", "Netanyahu", #GazaUnderAttack, #CharlieHebdo, and #JeSuisCharlie don't result in hundreds of spam tweets anymore. Unfortunately hashtags like #BBCNews, #AFP, #IslamicState, are still clogged, but kudos to Twitter and the support folks for finally doing something about this obnoxious nonsense.

UPDATE #3:
There is a new set of spam bots that has been operational for just over a week which I'd not seen yet.

They also link to some youtube videos, and a file at 4shared.com which is apparently owned by someone who is named here. The name again seems to be a fake.



They use an entirely different set of hashtags including:















I hope that Twitter does something about this parallel set of spam bots, and if this is a real name they are dealt with appropriately.

UPDATE #4:
All of the spam bot accounts that I have seen are suspended! I've tried searching for all the various hashtags and nothing shows up. Hopefully this is permanent and the spam bots don't start up again.

UPDATE #5:
The bots are back in town


UPDATE #6:
More bots
they appear to be using some strange service or hack to post these tweets. usually TweetDeck will tell me what app or site the user is using to post their tweets (so here is my tweet showing I use TweetDeck). When something like this showing "TweetDeck" or "Twitter Web Client" shows up, the text is a clickable link. These clickable links either don't lead anywhere or they redirect to sites that have invalid security certificates. 

UPDATE #7:
The bots are still going and Twitter doesn't care. Just counting these 10 accounts there are close to 900k tweets now (this screenshot was taken a few days ago and each bot posts just under 1k tweets per day)

Including this other account which I neglected to include there are over 1 million spam tweets. I find it strange that they wouldn't care about halting this.

UPDATE #8:
The bots have evidently ceased tweeting. They appear to be still active accounts and not banned or suspended, but none of the ones I am familiar with have tweeted in 15 hours. Hopefully this is the end of the plague, but they've proven malleable and capable of change so I am not too optimistic.


UPDATE #9:
Khamenei released another open letter, and coincidentally an inordinate number of bots started tweeting his nonsense. The letter was released yesterday, and the bots started tweeting immediately. The patterns of tweeting are different (it seems one account will send around 10 very quickly, and then another account will emulate this), but the fact that they are also using a service spoofer, and they seem to have started tweeting this letter almost immediately makes me think there is a connection to the regime. There are still some incompetencies including broken hashtags, but they are using mostly photos of people that appear to be moderately realistic (compare to the last set where there were photos of an Orthodox Jew tweeting Islamist rhetoric). 






Lastly the profile pictures do appear to be stolen, though as I mentioned they are much less suspicious than previous versions. 

At the same time, it appears as though several Iranian (and non-Iranians) journalists that had tweeted about the Ayatollah's letter have been suspended by Twitter per Iranian government request? At the same time Twitter ignores this same government's spam bots abusing its service? 

UPDATE #10:
Another weird development. It appears as though the spam continues, and the spamming accounts are not blocked, but their spam tweets aren't also showing up and searching for the hashtags used results in no results. To test this, I tweeted with the #Letter4U hashtag and it did show up in the search results. I also tried this with #CommonWorry and a similar thing happened




UDATE #11 (12/15/15):
Another strange development. A series of bots tweeting in Dutch about Khamenei's letter. This group has between 7000 and 63000 followers, follows 18-63 accounts, has tweeted 138-163 times (as of this update), and has 'liked' 71-79 tweets. They are all using the same service spoofing methods as previous bots. I am curious why they chose to tweet in Dutch and if there are parallel set-ups in other languages. I would suspect that the followers are bought. 




accounts used: QuyhgMelton
RebeccaOyiuhjy
NneitensteinAa
MikDean201
RarickR16
QoscarUrian
mui_rebecca
Second group:
PeterStekiel
Ania_Niedieck
Nina_Braun12
B__Muller
OY123121

Taking names and photos from different accounts to create spam accounts

UPDATE #12 (12/16/15):
I found some German spam bots tweeting about the letter: 
kluge_diana
ZManuela2
DuerrJurgen
mahler_stefanie
eric_wagner0
donnacasshrist1
flix_schulz
KrugerRobert5
tracyspeterson

They have very different metrics than the Dutch set. Namely, less followers and more tweets. 


UPDATE #13 (12/16/15):
More bots, posting graphics about Khamenei's letter, or terrorism or whatever. Using trending hashtags in all different languages.
Also the bots have figured out how to get past Twitter's filtering of the #Letter4U and #CommonWorry hashtags





UPDATE #14 (12/21/15)
The bots from Update #13 have been suspended, while the bots from Update #12 ceased tweeting 6 days ago.
However, another set of new bots with quite a few followers have emerged. These look like the most sophisticated by far, even though they clearly are bots. They tweet without links or photos at times, and do so in a way that makes it seem as though they are real users. It is clear they are not because these bots copy each other verbatim. These changes appear to have fooled whatever basic filter Twitter's staff implemented to mute them. The bots tweet in at least 2 languages, and I would suspect they use more than just these two. As the last 8 months have demonstrated Twitter has no interest in stopping regime sanctioned spam bot floods, while they BANNED Sputnik_INTL a clearly marked parody account mocking the "news" org Sputnik. Curious that their actions have supported Russia and Iran... 






UPDATE #15 (12/22/15):
There is now a group of MeK bots tweeting and retweeting each other about Iran regime abuses and various other current affairs news. They are also using the #Letter4U hashtag sometimes which the filter put in place by Twitter is incapable of catching. The bots link to an MeK site where news stories (or propaganda) are hosted. These are often taken verbatim from other sites.


UPDATE #16 (02/05/16):
The author and journalist Azadeh Moaveni wrote for Foreign Policy about attempts from Iranian intelligence to entrap her and to also get advice on how to promote the #Letter4U campaign. There clearly are major deficiencies in the execution of the outreach program. I also stumbled upon a bizarre group that set up a booth at Wayne State University near Detroit (and Dearborn, Michigan) to promote the Ayatollah's message and letters. This group seems to be affiliated with a Canadian NGO. It is unclear if any laws are being broken by promoting Iran regime propaganda, but they've not seem to gained much attention so far so I would assume its not of great concern at the moment. 
Posted by at No comments:
Labels: , , ,

Monday, March 2, 2015

Iranian Media supporting Kirchner

Argentine President Cristina Kirchner insists that she and her late husband have not worked to cover up Iranian involvement in the AMIA bombing, and it appears as though she is supported by Iranian media outlets.

A few days ago there was a march in support of Kirchner in Buenos Aires, which received virtually no coverage in the English language international media (The local Buenos Aires Herald covered the march). There were a few exceptions including NDTV, SBS and Rappler, though the articles posted by these sites were exact copies of each other and appear to be based off this Yahoo News article. What was most striking in the international coverage (or lack thereof) is that both PressTV and Tasnim, relatively major Iranian media sites covered the rally.

PressTV initially claimed that tens of thousands of supporters of the president demonstrated before upgrading their estimate to 300 thousand demonstrators (despite the unfavorable weather). Tasnim concurred.

The Israeli site i24News briefly mentioned the march in an article, noting that the 'municipal police' stated that as many as 400,000 marchers participated, while 'federal police' claimed a mere 50,000.

A march of hundreds of thousands of people is newsworthy no matter the circumstances. The drama over the death of Alberto Nisman, and the shockingly inept mismanagement of the situation by the Argentine authorities increases the potential news value of the story. While other incidents including the assassination of Boris Nemstov may have momentarily distracted the international press, Buenos Aires is a massive city (one of the most populated metropolitan areas of the world), and any significant event *should* have been noticed?

How could there be so little coverage from major media outlets if this rally was in fact so large? The 18F silent march only a week and a half prior to this was covered extensively by major outlets. The Guardian's coverage mentions the same statements made by Kirchner, yet neglects to mention the rally. Why did the Iranian press make such a big deal about this march, and why did they claim such a high and specific turnout?

Maybe it is just a coincidence, but it looks to me like Iran is doing Kirchner a favor for her assistance in delaying/disturbing the AMIA investigation.
Posted by at No comments:
Labels: , , ,

Tuesday, February 24, 2015

More Iranian Nuclear Sites?

The MeK announced today that they have more evidence of Iranian nuclear intransigence. According to news reports, a site in northeastern suburban Tehran houses a secret underground facility where uranium enrichment has occurred for nearly a decade.

The MeK press release is available on DropBox, and details their history in revealing information about Iran's nuclear facilities. Strangely enough, in this history they neglect to include another 'revelation' made a mere 16 months ago. At this time it was claimed that an underground facility around 70 km northeast of Tehran under a mountain near the town of Damavand housed more illegal Iranian nuclear activities, though the details were unclear.

I noted a few problems with the claims, notably the notorious unreliability of the MeK, as well as the very suspicious timing. Less than a month prior, the most left-leaning candidate, Hassan Rouhani, was elected president of Iran in a shockingly uncompetitive landslide. This 'revelation' was no doubt intended to ruin any possible good will or potential rapprochement between Iran and the West.

Today as well, the timing is suspicious. Rumblings from both Iranian and international press seem to indicate an optimism that a nuclear deal is imminent. The MeK is trying to remain relevant, while also scuttle any possibility for a nuclear deal while alleging that Iran's actions are so terrible that a nuclear deal would be a terrible thing for the West. They have been right in the past, but this is not always the case, and the example of July 2013 shows, they are not reliable.

UPDATE:
I should have trusted my gut and checked the image used for the safe door. Others have noted that it is in fact copied from the website an Iranian company that sells safes. The MeK's website put forward a bizarrely fitting rambling refutation which makes them look like liars, and incompetent ones at that.

While the color appears slightly different in the background it is clear that the image is the exact same as the one on the company sales website. The major difference is that there are horizontal white lines across.

Here is a comparison of the images
It is clear that the coloration and saturation are nearly identical. The image used is clearly the same. 

The MeK claim that this image is taken from one of their sources, yet they have no explanation for why the EXACT same photo, with the same detailed bricks, and spots are used. For this to have happened naturally the picture would have to have been taken from the exact same spot and the camera would have had to have been held at the exact same height. 

The complexities of creating this exact same situation make the MeK claims laughable. Furthermore, the image posted on the Iranian companies site is dated to February 12 of this year so it would have to be a hell of a coincidence for them to have posted photo that is now suddenly relevant.

As I'd mentioned before the MeK is of questionable reliability and this merely serves to reinforce my previous statements. 
Posted by at No comments:
Labels: , , , , , , , , ,

Sunday, January 25, 2015

Spinning the Syria Strike

This week the Israeli military allegedly struck a convoy in Southern Syria, killing Jihad Mughniyeh, the son of the infamous Imad Mughnieyh, as well as an Iranian IRGC general, several other Hezbollah fighters, and several other Iranian soldiers. This event has been a hot topic in the press, though the information released by the Israelis and the Hezbollah/Syria/Iran/Lebanon axis has proven contradictory, incoherent and nonsensical.

Initial reports indicated that helicopters had carried out the attack, and this claim has been repeated by all sides; Lebanese, Israeli and even Iranian. It would be strange for the Israelis to risk helicopters and the pilots/gunners/whoever else when they possess a large number of drones, not to mention their advanced fighter jets, and artillery capabilities. A drone strike makes a lot more sense, especially when the target was a group of individuals and it appears as though there were no Israelis on the ground inside Syria (the other possible reason why helicopters could have been used).

The Syrian media claimed that the strike was located within the Quneitra Governorate. This area is mostly located inside the Israeli-controlled Golan Heights and bordered by the Rif Dimashq Governorate (Damascus countryside) on the other side, so the remaining areas where the strike could have occurred are extremely limited. Additionally, a portion of the governorate controlled by Syria is the UNDOF DMZ.
Quneitra Governorate (Wikipedia)

The UNDOF stated that they had observed Israeli drones flying over their base at position 30 (Jabata al Khashab) which is slightly north of the mostly abandoned town of Quneitra, and is located closer to the Mount Hermon mountain range.
UNDOF Deployment (Wikipedia)
Jabata al Khashab is the town just to the left (West) of the quarries. Hermon is in the background

The UNDOF also claimed to observe smoke rising slightly after the drones flew past. Given the location of this observation post and the terrain in the area, this once again limits the possiblities. Footage from al-Manar, while inconclusive, seems to hint that the strike happened very close to the Hermon mountain range.

As of yet, the precise location of the strike has yet to be determined, but it appears as though the strike would have occurred on the Syrian side of the DMZ, leaving a tiny sliver of terrain where the strike would have had to happened if it truly was inside Quneitra Governorate.

This leads to the next question, which is why the Israelis chose to attack this particular convoy. Initially it was claimed that the reason for the strike was that the targeted individuals had been planning an attack on Northern Israel. Later however, an Israeli official leaked that they did not intend to kill the Iranian general, and that 'it believed it was attacking only low-level guerillas'. So why would they attack this particular group, and why would they bother with 'low-level guerillas'? An article in the Jerusalem Post stated that this attack was intended to 'thwart an attack on Israel', but this seems disingenuous.

Israel has struck Syria several times over the last few years, most times it was thought that the strikes were intended to prevent Hezbollah and/or Syria from crossing a 'red-line' (usually transferring advanced weapons to the terror group). There have been a few instances where the IDF has returned fire after facing fire from the Syrian side, but this is not something that happens every time munitions land in Israel. Dozens, if not hundreds of mortars have landed beyond the DMZ, inside the Israeli-controlled Golan, without an Israeli armed response. Mortars are of limited range, and to miss a target by miles is hardly 'accidental'. There have also been instances of "stray" gunfire hitting IDF troops, as well as purposeful attacks.

What made this convoy such an important target to attack? Recent Israeli actions in Syria have been limited and selective, despite the ongoing hostilities in and around Quneitra. Would they risk an attack on a convoy without knowing who was in it? I would imagine that they must have had some ideas who was there, and they'd determined that the targets were high-value. Otherwise, why would they attack a small convoy? Was the strike a response to the bombastic speech from Hassan Nasrallah three days prior?

A few weeks ago Hezbollah admitted that the head of their Unit 910 (tasked with 'external operations') was in fact an Israeli asset. He and his accomplices had given information to Israel on a variety of subjects, most notably, the identities of the Burgas Bombing suspects. Given the timing of this, I wonder if the Israelis felt pressure to act on whatever remaining intel they had from the burned asset. The actions by the Israelis seem rash, was there a limited amount of time to act on the information? Why else would they risk aggravating the Iranians and Hezbollah so soon after the last summer's war in Gaza?

Yesterday a Lebanese paper claimed that according to Hezbollah, the strike took place because the Iranian general had not turned off his cell phone, which allowed the Israelis to locate him. Does this statement mean anything or is Hezbollah trying to distract from a massive intelligence and logistical failure? Hezbollah implied that the normal procedure is for cell phones to be turned off, and because the phone was on, the Israelis were able to realize who it was.

Why is a cell phone able to identify the place as a target or was it this particular cell phone which was incriminating? Did the Iranian general have a standard mobile phone with an Iranian SIM card inside? How else could this information be of any use to Israeli intelligence? Do Syrians (military, civilians or rebels) normally travel with their cell phones turned off in this part of the country? If it was the actual phone, would this indicate that the Israelis have managed to infiltrate either the Syrian or Iranian or Lebanese mobile networks and identified the phones used by military officials?

This entire affair is chock full of misinformation, illogical claims and subterfuge. Other analysts like Yossi Melman and Dan Raviv have similarly questioned the Israeli claims. There are so many problems with the narrative from both sides, and the actions and reactions of the parties involved seem atypical. I expect a further set of leaks in the near future.
Posted by at No comments:
Labels: , , , , , , , , , ,

Tuesday, January 13, 2015

Syrian Nuclear Aspirations?

Der Spiegel this week alleged that Syria is attempting to work towards a nuclear weapon, with varying types of assistance from Iran, Hezbollah and North Korea. If true, this would be a massive story, with significant geopolitical ramifications. Syria has denied the allegations.

Syria is party to the Nuclear Non-Proliferation Treaty, as is Iran, while North Korea is not. Under this treaty, states are prohibited from developing nuclear weapons and from helping others develop these technologies.

In 2006, the IAEA ruled that Iran is in "non-compliance" with the NPT, namely, Iran's safeguards agreement. If these new allegations are true, Iran would be in blatant violation of this treaty. Given the attempted rapprochement between Iran and the West, primarily regarding its nuclear program, a discovery of this nature would almost certainly cause irreparable damage to ongoing nuclear negotiations. Iran would also face new, harsh sanctions.

The report from Der Spiegel however, is poorly sourced, and experts have claimed that the information contained in the report is in fact, incorrect. The report cites "Western intelligence agencies" as the source for this information, and indicates that Der Spiegel has documents from these sources showing that Syria is working to build a nuclear weapon.

As is the case with any anonymous source, a proper vetting of the information is necessary, yet in this instance near impossible. It would be very difficult to have two separate sources able to confirm this information. Information regarding Iran's nuclear program is notoriously hard to come by. While there have been cases when new and valid information was revealed, there are also many instances of false and misleading information released by the same sources.

It is best to take this report with a grain of salt. It is unclear if the documents held by Der Spiegel are legitimate, or an attempt by the hawkish members of the Western coalition who wish to avoid any reconciliation between Iran and the West, to falsify documents to push their agenda.
Posted by at No comments:
Labels: , , , , , , , , , , ,
Subscribe to: Posts (Atom)