Skip to main content

Popularity purchasers who buy fake ‘likes’ on social media could be hiring criminal botnets

faceless hacker in a black hoody
stevanovicigor / 123RF Stock Photo
Instant “social proof” via purchased social media likes and followers isn’t the sweet deal it may seem. Celebrities, performers, politicians, new businesses, or anyone else buying big bundles of fake followers are unknowingly paying cybercriminals who are using a botnet of hijacked Internet of Things (IoT) smart home devices to procure those social media numbers. The so-called “ego market” is becoming a lucrative, low-risk criminal enterprise.

GoSecure, a Canadian cybersecurity team gave a presentation at Black Hat Europe 2016 presentation on the ego market and its ties to botnets and cybercrime, reports International Business Times.

After the DDoS (Distributed Denial of Service) attack on DNS service provider Dyn  in late April, it was discovered that a large portion of the attacking systems likely consisted of hijacked IoT devices in people’s homes. Easy-to-hijack IoT smart home devices such as home thermostats, WiFi cameras, baby monitors, and garage door openers were used to barrage the Dyn servers, resulted in the overloading of major sites and the slowing of the internet. Suddenly, many more people understood that botnets were dangerous tools used by cyber criminals that could work through hijacked home devices owned by unknowing, innocent people.

But not all cyber criminals set up and unleash botnets to run high-profile attacks. According to GoSecure, the Linux/Moose botnet isn’t used for DDoS attacks or to target people or political causes. Businesses that sell fake social media likes and followers, especially on Instagram, use the Linux/Moose botnet to send new account requests and then follow or like the users who pay for fake likes and followers in bulk.

According to the report, the current rate for 10,000 new Instagram followers is $112.67. It costs $158.99 for 10,000 likes. When GoSecure reverse engineered Linux/Moose, they found it used IoT home routers to set up the fake accounts. According to their sleuthing, GoSecure found that each individual device on the botnet was responsible for approximately 1,186 Instagram followers each month, generating the company up to $13.05. That may not seem like much, but when you start multiplying by tens of thousands of devices, or ‘bots,’ the dollars add up fast. When they ran the numbers for Linux/Moose, GoSecure found that the botnet could earn close to $700,000 a month selling batches of fake followers and likes.

With this business model, Linux/Moose stayed under the radar of criminal investigative groups more focused on denial of service and other forms of malicious attacks. The companies that use the botnet advertise openly and even accept credit cards and PayPal payments.

“It looks legitimate. The criminals make money and they probably declare taxes on it, but it’s all happening on a botnet,” GoSecure’s cybersecurity research head Oliver Bilodeau told International Business Times U.K. “There’s no direct victims to the crime. This is the next thing the criminals are moving to because there’s a low risk of getting caught and even if they do get caught, the damages would be complicated to explain to the judge. It’s a very clever scheme, quite a perfect cybercrime.”

The irony is that purchased fake followers are eventually detected and flagged as spam by social media networks. To protect your own home devices from botnet hijacking, read this article.

Bruce Brown
Digital Trends Contributing Editor Bruce Brown is a member of the Smart Homes and Commerce teams. Bruce uses smart devices…
WhatsApp now lets you add short video messages to chats
WhatsApp logo on a phone.

You can now send short video messages in a WhatsApp chat, Meta announced on Thursday.

A video message can last for up to 60 seconds long and is protected with end-to-end encryption.

Read more
Musk shows off new X sign on top of San Francisco HQ, but the city’s not happy
The new X sign replacing the Twitter logo on the company's headquarters in San Francisco.

Soon after Elon Musk tweeted a drone video showing a new white light in the shape of an X atop the company’s headquarters in San Francisco on Friday, the Associated Press (AP) reported that the city had decided to launch in investigation over concerns that the sign's installation may have broken rules.

The X logo is replacing the iconic Twitter bird as Musk continues efforts to rebrand the social media platform that he acquired in October.

Read more
Threads has lost half its users, according to Meta chief Zuckerberg
Instagram Threads app.

Meta’s Threads app looks set for an uphill climb if it’s ever to take the microblogging crown from Twitter, which is currently being rebranded as X.

Meta CEO Mark Zuckerberg recently told employees that despite its impressive start in early July when around 100 million people activated a Threads account in its first five days of availability, more than half of those users have stopped checking in.

Read more