What Secrets Lie Behind Cyber Security Sock Puppets?

Unveiling the Dark Truth Of Cyber Security Puppets

By Tom Seest

What Secrets Lie Behind Cyber Security Sock Puppets?

At BestCybersecurityNews, we help entrepreneurs, solopreneurs, young learners, and seniors learn more about cybersecurity.

Sock puppets are sophisticated fake social media accounts used by OSINT investigators for research without revealing their real identities, often for both benign and malicious purposes.
From an OPSEC perspective, creating a secondary profile that doesn’t directly connect back to an investigator can be useful in protecting his or her identity and keeping OSINT investigations separate from personal accounts that could give away his or her presence or reveal his or her intentions to targets.

What Secrets Lie Behind Cyber Security Sock Puppets?

Who Controls the Cyber Security Sock Puppets?
What Makes a Sock Puppet Effective?
Who Is Pulling the Strings Behind Cyber Security Sock Puppets?
Who is Behind Cyber Security Sock Puppets?

Who Controls the Cyber Security Sock Puppets?

Sock puppets are online pseudonyms used by OSINT investigators to hide their true identities when gathering intelligence on targets, or malicious actors for disinformation campaigns on social media or other forums.
People looking to influence public opinion about an issue would previously use “AstroTurfing,” creating multiple accounts and posting different comments under various names, which were then shared across the internet and spread by bots re-posting these comments as they circulated around. AstroTurfing proved highly successful at shifting public attitudes or changing minds; today sock puppets can be more sophisticated and targeted; for instance a group of terrorists could hire a company that creates fake accounts publishing propaganda which then get posted back onto social media and platforms by bots re-posting bots re-posting them via bots.
Sock puppets can also be employed by political, commercial, and religious groups as disinformation campaigns. These accounts are set up with the purpose of spreading misinformation in an attempt to change public opinion; or possibly used for promotion or detraction purposes. Although it’s impossible to stop such activity completely, it’s still important to remain aware of their existence so as to recognize when these occur.
OSINT investigators often create sock puppets to gain access to content that requires accounts for viewing. It is critical that they can protect OPSEC (operational security). If an investigator uses their real name in their research account, they could accidentally “like” or send friend requests to potential targets without meaning to.
To create a sock puppet, start by finding an old sock and cutting off its toes. Next, cut an oval-shaped piece of cardboard into half to crease its middle before gluing it to your sock puppet as its body. Finally, add any decorations such as eyes, yarn for hair or other features that add personality.

Who Controls the Cyber Security Sock Puppets?

What Makes a Sock Puppet Effective?

Sock puppets, used by malicious actors and OSINT investigators alike, are created online as fictitious identities to conceal people’s true identities and can help protect against cyber-attacks. By creating these online identities with anonymity in mind, these accounts provide malicious actors and OSINT investigators a means of accessing content that requires accounts, collecting intelligence on targets without them knowing it exists, or investigating cyber attacks more efficiently.
Sock puppets are commonly employed by political and commercial entities to give the appearance that multiple individuals support a certain viewpoint, idea, or action – often to influence public opinion in their favor. Though sock puppets may often be created for malicious reasons, they can also serve legitimate functions like posting memes to social media or engaging in discussion forums.
Sock puppets, also referred to as fake accounts, alternate identities or personas, are frequently employed by malicious actors for deceptive purposes – typically to launch phishing attacks. Security firm Proofpoint has observed instances in which threat actors used multiple email personas within one chain of phishing emails they sent out.
Establishing a sock puppet requires careful consideration in order to appear legitimate, including creating daily activities and connections over an extended period. Furthermore, using an account with real names rather than pseudonyms will make it more difficult for targets to detect it as being fake.
Once you have established a sock puppet account, it is vitally important that a burner phone or sim card be used so as to disassociate its activities from being tied back to you – this way any activity taking place under its name remains undetectable and cannot be traced.
The first steps in making a sock puppet include finding an appropriate piece of fabric for its body – typically, an old sock is ideal, though any fabric type will work. Cut cardboard to the same dimensions can also work; use paper or cardboard to shape an oval mouth shape that matches up with the size and color of an existing sock; glue pom poms onto its nose as necessary, and once complete it can be adhered back onto the backside of a sock puppet for easy gluing!

What Makes a Sock Puppet Effective?

Who Is Pulling the Strings Behind Cyber Security Sock Puppets?

Sock puppets are an indispensable asset for OSINT investigators when conducting open-source research. By creating one of these “false identities”, OSINT investigators can gather information without exposing their real identities or social media accounts directly – an essential step to maintain operational security (OPSEC). However, in order to successfully create one themselves they must understand which platforms recognize such accounts and take precautions against being flagged for unusual activity on those platforms.
At first, an investigator should create a persona or fake identity for their sock puppet. This should include providing details such as name, address and occupation as well as including an avatar or picture that represents this identity. Female personas tend to raise less suspicion than their male counterparts; also make sure that it sounds natural by speaking the correct dialect in its region.
Once an investigator has created their sock puppet, they can begin investigating their target. It is recommended that they keep their sock puppet active for at least 24 hours after creation to avoid being flagged by platforms as suspicious activity and ensure their account uses a VPN and a public Wi-Fi network so their real IP address won’t be recorded.
Planned investigations will help sock puppet creators remain organized and avoid losing track of their research. Furthermore, having backup plans may prove invaluable should something go amiss with the main puppet. Please note that certain sites prohibit creating sock puppets, so it is wise to check each platform’s policies before proceeding with your creation process.
When creating a sock puppet, multiple people should assist with its creation to increase speed and efficiency. Furthermore, all information should be thoroughly sanitized before being passed on to its intended target for investigation – this will reduce chances of the target detecting your fake persona before you finish creating your sock puppet.

Who Is Pulling the Strings Behind Cyber Security Sock Puppets?

Who is Behind Cyber Security Sock Puppets?

Cyber security sock puppets are used by malicious actors and OSINT investigators to collect intelligence on targets without being tracked back to them, often used for retaliation, disinformation campaigns or circumventing block evasion on social media platforms. Mariel Klosterman of Dakota State University, an emerging cybersecurity researcher, has shared in a Hg Summer FactSheet the importance of creating an alias when investigating a target. She emphasizes the significance of creating an effective OSINT investigation by creating a convincing fake persona that elicits responses from the target as well as providing anonymity for operational security purposes.
When creating a sock puppet, it is critical to take your time in building its network and connecting accounts. While this step may take time and patience, if done right, it should make creating the puppet harder for anyone else to detect.
Communities of sock puppets tend to share common characteristics and provide researchers with a valuable tool. Such characteristics could include hobbies, social functions, occupations or viewpoints. Researchers have successfully used community detection as an approach for identifying sock puppets.
The key among sock puppets is their high connectivity. This is due to them often using private or alias accounts which are easier to connect than real identities, while many also maintain networks of friends and followers connected through these virtual personas. Furthermore, many do not change their name when creating multiple sock puppets but reuse the same name on multiple platforms – another key characteristic.
For maximum anonymity when creating an account, VPN or TOR use should be utilized when opening one. This will help ensure that any fake content doesn’t tie back to their identity and further ensure no link can be established between fake names or locations created when opening an account and its creator’s real-world identity. Furthermore, using fake names and locations when opening accounts further helps the anonymity of identity.