Comment by Riaz Haq on January 16, 2021 at 9:34am

India, Pakistan among 7 nations with state actors active online for propaganda: Study
In India, cyber troop activity was found in two instances by a political party or politicians, three or more instances by a private contractor, on one instance by civil society organisation, and one by citizens and influencers.

https://indianexpress.com/article/india/india-pakistan-among-7-nati...

India figures in a small bunch of seven countries — along with China, Iran, Pakistan, Russia, Saudi Arabia, and Venezuela — where state actors use computational propaganda on Facebook and Twitter to influence global audiences, according to a comprehensive report on disinformation campaigns released by the Computational Propaganda project at Oxford on Thursday.

The report found at least seven instances of “cyber troops” in India, and private contractors came out to be the most active “cyber troops” in the country.

These troops are “government or political party actors tasked with manipulating public opinion online”, according to the report, and only Malaysia, Philippines, the UAE, and the US had as many or more instances as India. The report labelled India as “medium-capacity” for “cyber troops”. It stated, “Multiple teams ranging in size from 50-300 people. Multiple contracts and advertising expenditures valued at over 1.4M US.” Other countries in the category are Brazil, Pakistan, and the UK.

Over three years, the researchers examined 70 countries in which these operations do three things: suppress fundamental human rights, discredit political opposition, and drown out political dissent.

In India, cyber troop activity was found in two instances by a political party or politicians, three or more instances by a private contractor, on one instance by civil society organisation, and one by citizens and influencers.

In the first big crackdown on fake accounts for “inauthentic behaviour” in the run-up to Lok Sabha polls in April, Facebook removed more than 700 pages, groups and accounts from India. Those taken down include accounts associated with the Congress IT cell and Silver Touch Technologies, a company that has worked for the government and the BJP. They were taken down for attempts to deceive users of their identities, according to the company.

The report found that in India, bot-led automated manipulation as well as human-led manipulation spread propaganda for a party, attacked its political opposition, and spread polarising messaging designed to drive divisions.

In India, it found the use of disinformation and media manipulation, data-driven strategies, amplifying content by flooding hashtags, and troll armies that harass dissidents or journalists online. The only technique that the researchers did not find in India that was present in other countries was mass-reporting of content or accounts.

“The co-option of social media technologies provides authoritarian regimes with a powerful tool to shape public discussions and spread propaganda online, while simultaneously surveilling, censoring, and restricting digital public spaces,” the report says.

Of the 70 countries, 44 had campaigns conducted by government actors, such as a digital ministry or the military, and 45 had campaigns led by political parties or politicians, the report found. This is a 150-per cent increase in countries using organised social media manipulation campaigns.
This year, 70 countries saw campaigns of this kind; the corresponding figures 48 in 2018, and 28 in the year before.

The methodology involved news reporting analysis, a secondary literature review of public archives and scientific reports, drafting country case studies, and expert consultations.

On a platform-wise breakdown of the campaigns, India appeared on Facebook, WhatsApp and Twitter but not on YouTube and Instagram. Even with a growth of these activities on WhatsApp, Instagram and YouTube, the report found that Facebook still firmly remained the platform with the most manipulation activity.

Comment by Riaz Haq on February 15, 2021 at 11:39am

#US company unmasks state-sponsored Android spyware tied to #India. #Spyware targets personnel linked to #Pakistan’s #military and #nuclear authorities & #Indian election officials in Indian Occupied #Kashmir. Also Pakistani nationals in #UAE and #India. https://www.securitymagazine.com/articles/94573-lookout-unmasks-sta...

Lookout, Inc., provider of mobile security solutions, announced the discovery of two novel Android surveillanceware, Hornbill and SunBird. The Lookout Threat Intelligence team believes these campaigns are connected to the Confucius APT, a well-known pro-India state-sponsored advanced persistent threat group. Hornbill and SunBird have sophisticated capabilities to exfiltrate SMS message content, encrypted messaging app content, geolocation, contact information, call logs, as well as file and directory listings. The surveillanceware targets personnel linked to Pakistan’s military and nuclear authorities and Indian election officials in Kashmir.

The Confucius group was previously reported to have first leveraged mobile malware in 2017 with ChatSpy[1]. However, based on this new discovery, Lookout researchers found that Confucius may have been spying on mobile users for up to a year prior to ChatSpy with SunBird. SunBird campaigns were first detected by Lookout researchers in 2017 but no longer seem to be active. The APT’s latest malware, Hornbill, is still actively in use and Lookout researchers have observed new samples as recently as December 2020.

“One characteristic of Hornbill and SunBird that stands out is their intense focus on exfiltrating a target's communications via WhatsApp,” said Apurva Kumar, Staff Security Intelligence Engineer at Lookout. “In both cases, the surveillanceware abused the Android accessibility services in a variety of ways to exfiltrate communications without the need for root access. SunBird can also record calls made through WhatsApp’s VoIP service, exfiltrate data on applications such as BlackBerry Messenger and imo, as well as execute attacker-specified commands on an infected device.”

Both Hornbill and SunBird appear to be evolved versions of commercial Android surveillance tooling. Hornbill was likely derived from the same code base as an earlier commercial surveillance product known as MobileSpy. Meanwhile, SunBird can be linked back to the Indian developers responsible for BuzzOut, an older commercial spyware tool. The Lookout researchers' theory that SunBird’s roots also lay in stalkerware is supported by content found in the exfiltrated data that they uncovered on the malware’s infrastructure in 2018. The data uncovered includes information about the stalkerware victims and campaigns targeting Pakistani nationals in their home country as well as those traveling abroad in the United Arab Emirates (UAE) and India.

Comment