this post was submitted on 19 Jul 2023
1183 points (98.8% liked)

World News

38553 readers
3204 users here now

A community for discussing events around the World

Rules:

We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.

All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.


Lemmy World Partners

News [email protected]

Politics [email protected]

World Politics [email protected]


Recommendations

For Firefox users, there is media bias / propaganda / fact check plugin.

https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/

founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] mea_rah 1 points 1 year ago (3 children)

Well you do if you want to receive the confirmation text. And while you're at it, you might as well use the same cell tower for data so that you get "residential" IP.

You can definitely fake geolocation and perhaps you could fake IP through some proxy, but you can't use commercial VPN services as their IPs are well known VPN IP ranges at this stage. (these SIMs might have been used as such proxies for some spamming besides being used for this specific botnet) Effectively the more you want to blend in with the actual Ukrainian end user traffic, the more you need to be present in the country and the more complicated it is to fake it otherwise. Especially if you're trying to hide from state level investigation, that has access to triangulation from cell towers, providers logs, etc..

[–] another_lemming 1 points 1 year ago (2 children)

It's just I see one collab having a gateway on their PC for russian-based labs to operare rather than the whole scheme based oin Ukraine.

Cell-tower data would be hepfull to locate the guy, but do web\apps collect it?

[–] mea_rah 2 points 1 year ago (1 children)

You can do the gateway on a PC thing. You don't even need to have collaborator to do that, plenty of people run outdated systems riddled with malware.

But once you need actual working SIM (Telegram, Watsapp, etc..) you really need that SIM somewhere in Ukraine. And you need plenty of them. (see the pictures in the article, there's a ton) At minimum to activate the accounts and more realistically for occasional re-verification. (2fa) Sure you can then run actual bots in russia, but that need for physical presence is still there at least occasionally. The article mentions 100 individuals, when you consider that 150k SIMs were there, most of the operation indeed was in russia or somewhere else.

The triangulation is just a way to maybe correlate multiple SIMs in the same spot by Ukrainian officials once they had enough suspected malicious SIMs. (So that they know it's not just few random persons with malware on their phone, but it's indeed huge concentration of SIMs in one spot)

[–] another_lemming 1 points 1 year ago

Thanks for your detailed answers.