Read on Twitter
This thread is on how a graphic designers failure to close a file helped me expose a disinformation network
Back in October Reuters reported on the FBI prob into a Russian Internet Research Agency website masquerading as an American conservative blog, naebc[.]com https://twitter.com/jc_stubbs/status/1311616857414209536
Back in October Reuters reported on the FBI prob into a Russian Internet Research Agency website masquerading as an American conservative blog, naebc[.]com https://twitter.com/jc_stubbs/status/1311616857414209536
https://twitter.com/VickerySec/status/1311682344051380226
Chris Vickery then found that site, which was running on the popular Wordpress platform, had been misconfigured and the backend folder's, which contained the uploaded photos, were wide open to all
Chris Vickery then found that site, which was running on the popular Wordpress platform, had been misconfigured and the backend folder's, which contained the uploaded photos, were wide open to all
I downloaded the photos and checked them for metadata, data created when modifying or creating a file that is about the file. For example timestamps are metadata or what device the file was created on. In this case I found the logo for the website had metadata intact
The metadata showed the file was created in Adobe Illustrator on a computer using Russian as the file language https://twitter.com/z3dster/status/1312048117185867776
but it also showed something else that was easy to miss
You can stop here and click on the link to see if you spot it https://twitter.com/z3dster/status/1312056192508686336
You can stop here and click on the link to see if you spot it https://twitter.com/z3dster/status/1312056192508686336
Title is a user defined field in Adobe Illustrator
in this case the graphic designer in Russia opened a space to create an image for "Centrfrik-infos" and then didn't close the space before creating the logo for the American blog
in this case the graphic designer in Russia opened a space to create an image for "Centrfrik-infos" and then didn't close the space before creating the logo for the American blog
I googled Centrfrik-infos and found a Pro-Russia Facebook page targeting the Central African Republic https://web.archive.org/web/*/https://www.facebook.com/Centrfrik-infos-102005244754202/
From the email associated with that page I was able to find a few more pages, a twitter account, and one more Facebook page
@RobbyDelaware was able to find another website from one of the emails and again it had an open back end with photos with Cyrillic names
@RobbyDelaware was able to find another website from one of the emails and again it had an open back end with photos with Cyrillic names
at this point I realized that I was in over my abilities/toolkit and reached out to Facebook, to no success, and some professional disinformation orgs
Today they published their results along with Facebook
https://graphika.com/reports/more-troll-kombat/ https://about.fb.com/news/2020/12/removing-coordinated-inauthentic-behavior-france-russia/
Today they published their results along with Facebook
https://graphika.com/reports/more-troll-kombat/ https://about.fb.com/news/2020/12/removing-coordinated-inauthentic-behavior-france-russia/
I don't think http://archive.org was able to save the post because of cloudflare checks but these were my favorite images from the Russian CAR page
I guess when you are landlocked tractor parades replace boats
I guess when you are landlocked tractor parades replace boats
A final addition, apparently a graphic designer, maybe even the same one who screwed up before wasn't happy with their job
They created this image and named it фу.jpg
They created this image and named it фу.jpg
forgot about this one https://web.archive.org/web/20200711070759/https://twitter.com/BagazaMermose/status/1281842095691575297
https://web.archive.org/web/20200711070759/https://twitter.com/BagazaMermose/status/1281842095691575297
