Tactical Catfishing

Most of us think of ‘catfishing’ in the context of someone using a fake profile, usually on some dating app, to trick unsuspecting people. Maybe they do it for manipulation and blackmailing purposes, or to scam people out of money.

Now, however, a social engineering drill conducted by the NATO Strategic Communications Centre of Exellence (NATO StratCom COE) has shown us that these catfishing tactics can be used on soldiers to glean sensitive information about things like battalion locations, troop movements, and other personal intel.

The operation used the catfishing technique to set up fake social media pages and accounts on Facebook and Instagram with the intent of fooling military personnel. This clandestine operation, designed to take place over the course of a month, was arranged by a “red team” based out of NATO’s StratCom Center of Excellence in Latvia.

The falsified Facebook pages were designed to look like pages that service members use to connect with each other – one seemed to be geared toward a large scale military exercise in Europe and a number of the group members were accounts that appeared to be real service members.

The truth was, however, these were fake accounts created by StratCom researchers to test how deeply they could influence the soldiers’ real world actions through social engineering. Using Facebook advertising to recruit members to these pages, the research group was able to permeate the ranks of NATO soldiers, using fake profiles to befriend and manipulate the soldiers into providing sensitive information about military operations and their personal lives.

The point of the exercise was to answer three questions:

1. What kind of information can be found out about a military exercise just from open source data?

2. What can be found out about the soldiers just from open source data?

3. Can any of this data be used to influence the soldiers against their given orders?

Open source data relates to any information that can be found in public avenues such as social media platforms, dating profiles, public government data and more.

The researchers found that you can, indeed, find out a lot of information from open source data – and yes, the information can be used to influence members of the armed forces. The experiment emphasizes just how much personal information is ‘open season’ online, especially as our lives are increasingly impacted by our digital footprints.

Perhaps even more troubling is the fact that even those of us who are the best positioned to resist such tactics still managed to fall for them, illustrating just how easy it is for the average person with no experience with digital privacy.

Many of the details about how exactly the operation was conducted remain classified, such as precisely where it took place and who was impacted. The research group that ran the drill did so with the approval of the military, but obviously service members were not aware of what was happening.

The researchers obtained a wide range of information from the soldiers, including things like the locations of battalions, troop movements, photographs of equipment, personal contact information, and even sensitive details about personal lives that could be used for blackmail – such as the presence of married individuals on dating sites.

Instagram in particular was found to be useful for identifying personal information related to the soldiers, while Facebook’s suggested friends feature was key in recruiting members to the fake pages.

Representatives of the NATO StratCom COE stated that the decision to launch the exercise was made in the wake of the Cambridge Analytica scandal and Mark Zuckerberg’s appearance before U.S. Congress last year.

A quote from the report says:

“Overall, we identified a significant number of people taking part in the exercise and managed to identify all members of certain units, pinpoint the exact locations of several battalions, gain knowledge of troop movements to and from exercises, and discover the dates of active phases of the exercises.

“The level of personal information we found was very detailed and enabled us to instill undesirable behaviour during the exercise.”

Military personnel are often the target of scams like catfishing. Recently, a massive blackmailing scheme that affected more than 440 service members was uncovered in South Carolina, where a group of inmates had allegedly used fake personas on online dating services to manipulate the service members. This just goes to show that it’s not just finances at risk through catfishing, but security overall.

Facebook has taken a decidedly firm stance against the proliferation of fake pages and accounts designed to manipulate the public. The company prohibits what it calls “coordinated inauthentic behavior”, and has bolstered its safety and security team over the past year in an effort to combat phishing and other types of social scams.

But after the success of StratCom’s endeavor, it seems that Facebook’s efforts to crack down on this aren’t completely successful. Of the fake pages created, one was shut down within hours, while the others took weeks to be addressed after being reported. Some of the fake profiles still remain.

One thing to keep in mind is just how small-scale this experiment was in relation to the massive yield of information. Three fake pages and five profiles were all it took to identify more than 150 soldiers and obtain all of that sensitive information. This is tiny in comparison to the coordinated efforts of bad actors that utilize hundreds of accounts, profiles, and pages. One can imagine just how much data could be obtained through those schemes.

As a result of the study, the researchers suggested some changes Facebook could make to help prevent malign operations of a similar nature. For example, if the company established tighter controls over the Suggested Friends tool, it would not be quite as easy to identify members of a given group.

Digital privacy is especially important – the picture we present of ourselves across different social media platforms can help people build a clear idea of who we are, which could, consequently, be used against us in terms of manipulation tactics and social engineering.

The use of social media to gather mission sensitive information is going to be a significant challenge for the foreseeable future. The researchers suggest that we ought to put more pressure on social media to address vulnerabilities like these that could be used in broad strokes against national security or individuals directly.

Centry Global has a service for identity verification of online profiles. If you suspect you may be at risk for being manipulated, contact us at www.datecheckonline.com!

This article was written by Kristina Weber, Content Manager of Centry Global. For more content like this, be sure to follow us on Twitter @CentryGlobal and subscribe to Centry Blog for bi-weekly updates.