Hi..

Last year (for quite a while) we did some digging into the area of influencing online channels (and user generated content sites) with the use of sock-puppets. (We published a paper on it & presented on the topic at 2 conferences)

The reason we did the research is simple. We believe that censorship 2.0 will take a similar form (ie. the appearance of everyone having a voice, but then controlling which voices are actually heard).

During the testing we used sock-puppets on mailing lists (and measured their effects), sock puppets on social media networks and even used simple scripts to push old news stories to front pages of news sites. Along the way we found bugs in comments systems that allowed us to steal peoples identities and mine "hidden" information, and these were reported to the respective vendors and were fixed.

We also took aim at reddit..

In this case we used our sockpuppets to vote up stories, to vote down stories and combinations of the two. Predictably we found that moving stories up and down the reddit charts were relatively easily doable (with enough machine-time) but were then relatively surprised to find that moderators are not given enough access to data to make sock-puppet hunting easy enough.

This means that even mods who clearly had incident response skills, were unable to really do the triage necessary to identify/kill malicious actors (even when malicious activity was spotted). During the research, we were able to identify sockpuppets being used to dominate comment sections of popular online new-sites, and largely attributed our ability to detect this to the fact that the comment services had reasonable API's with useful access to data.

One of our suggestions was that reddit too, should open up this sort of access to their moderators, allowing mods the ability to do reasonable investigations & correlation.

But... We did mess up..

We really should have contacted the mods once the research was complete but instead we published and moved on. (A follow up piece of work: building tools to help detect sock puppet activity remains incomplete). We know some of the mods personally and the last thing we wanted was to negatively affect them (or to screw up communities they have been working to build for so long). For this, we are truly deeply sorry. We also note that we caused some consternation in the /r/netsec community itself in the few weeks that we were on it, and for this too, we apologise. Our aim was to raise awareness on how easily such attacks could be carried out (and to init discussions on how they could be fixed). We are genuinely deeply sorry for the pain caused to both the mods and the users of /r/netsec.

Edit (due to comment requests): * A copy of the slides can be seen here * A video of the presentation given at Troopers15 can be seen here * The paper can be read here