Popularity purchasers who buy fake ‘likes’ on social media could be hiring criminal botnets

Bruce Brown
Digital Trends
Popularity purchasers who buy fake ‘likes’ on social media could be hiring criminal botnets
All botnets aren't running massive DDoS attacks. The Linux/Moose botnet works through IoT home devices to create fake social media likes and followers. Fraudulent followers and likes are eventually detected and flagged as spam by social networks.

Instant “social proof” via purchased social media likes and followers isn’t the sweet deal it may seem. Celebrities, performers, politicians, new businesses, or anyone else buying big bundles of fake followers are unknowingly paying cybercriminals who are using a botnet of hijacked Internet of Things (IoT) smart home devices to procure those social media numbers. The so-called “ego market” is becoming a lucrative, low-risk criminal enterprise.

GoSecure, a Canadian cybersecurity team gave a presentation at Black Hat Europe 2016 presentation on the ego market and its ties to botnets and cybercrime, reports International Business Times.

After the DDoS (Distributed Denial of Service) attack on DNS service provider Dyn  in late April, it was discovered that a large portion of the attacking systems likely consisted of hijacked IoT devices in people’s homes. Easy-to-hijack IoT smart home devices such as home thermostats, WiFi cameras, baby monitors, and garage door openers were used to barrage the Dyn servers, resulted in the overloading of major sites and the slowing of the internet. Suddenly, many more people understood that botnets were dangerous tools used by cyber criminals that could work through hijacked home devices owned by unknowing, innocent people.

More: Bot-hunting ‘FRAUDAR’ algorithm will name and shame fake users on social media

But not all cyber criminals set up and unleash botnets to run high-profile attacks. According to GoSecure, the Linux/Moose botnet isn’t used for DDoS attacks or to target people or political causes. Businesses that sell fake social media likes and followers, especially on Instagram, use the Linux/Moose botnet to send new account requests and then follow or like the users who pay for fake likes and followers in bulk.

According to the report, the current rate for 10,000 new Instagram followers is $112.67. It costs $158.99 for 10,000 likes. When GoSecure reverse engineered Linux/Moose, they found it used IoT home routers to set up the fake accounts. According to their sleuthing, GoSecure found that each individual device on the botnet was responsible for approximately 1,186 Instagram followers each month, generating the company up to $13.05. That may not seem like much, but when you start multiplying by tens of thousands of devices, or ‘bots,’ the dollars add up fast. When they ran the numbers for Linux/Moose, GoSecure found that the botnet could earn close to $700,000 a month selling batches of fake followers and likes.

With this business model, Linux/Moose stayed under the radar of criminal investigative groups more focused on denial of service and other forms of malicious attacks. The companies that use the botnet advertise openly and even accept credit cards and PayPal payments.

“It looks legitimate. The criminals make money and they probably declare taxes on it, but it’s all happening on a botnet,” GoSecure’s cybersecurity research head Oliver Bilodeau told International Business Times U.K. “There’s no direct victims to the crime. This is the next thing the criminals are moving to because there’s a low risk of getting caught and even if they do get caught, the damages would be complicated to explain to the judge. It’s a very clever scheme, quite a perfect cybercrime.”

The irony is that purchased fake followers are eventually detected and flagged as spam by social media networks. To protect your own home devices from botnet hijacking, read this article.