Recent spread of fake executive profiles on LinkedIn It creates something of an identity crisis for the business network website and the companies that rely on it to recruit and screen potential employees. Fake LinkedIn identities—which link profile images generated by artificial intelligence to text from legitimate accounts—create major problems for the company’s HR departments and for those who manage invite-only LinkedIn groups.
Some fake profiles flagged by the co-admin of the popular sustainability group on LinkedIn.
Last week, KrebsOnSecurity checked A torrent of non-original LinkedIn profiles All are demanding Chief Information Security (CISO) roles across various Fortune 500 companies, including BiogenAnd the chevronAnd the ExxonMobilAnd the Hewlett-Packard.
Since then, the response from LinkedIn users and readers has made it clear that these fake profiles appear collectively for nearly all executive roles – but especially for jobs and industries adjacent to recent world events and news trends.
Hamish Taylor run the Sustainability specialists A group on LinkedIn, which has over 300,000 members. Together with the group’s co-owner, Taylor said they banned Over 12,700 suspected fake profiles so far this yearincluding dozens of recent novels that Taylor described as “satirical attempts to manipulate humanitarian and crisis relief experts”.
“We receive over 500 fake profile requests to join on a weekly basis,” Taylor said. “Hell has been hitting since about January of this year. Before that we didn’t get the swarms of fakes that we see now.”
The opening slide of the Taylor Group’s appeal to LinkedIn.
Taylor recently posted a LinkedIn post titled “LinkedIn Fake Identity Crisis, who mocked the “60 Least Wanted Crisis Relief Experts” – fake profiles that claimed to be experts in disaster recovery efforts in the aftermath of recent hurricanes. The images above and below show only one swarm of profiles that the group identified as non-original. Almost all of these profiles have been removed from LinkedIn after KrebsOnSecurity tweeted about them last week.
Another “swarm” of LinkedIn bot accounts identified by Taylor’s group.
Mark Miller is the owner DevOps . group On LinkedIn, he says he deals with fake profiles on a daily basis – often hundreds a day. What Taylor called “swarms” of fake accounts Miller described as “waves” of requests from fake accounts.
“When the robot tries to infiltrate the group, it does so in waves,” Miller said. “We’ll see 20-30 requests that come with the same kind of information in profiles.”
After filming waves of suspected fake profile requests, Miller began sending photos to LinkedIn’s abuse teams, who told him they would review his request but might not be notified of any action taken.
Some of the bot profiles identified by Mark Miller were seeking access to his DevOps LinkedIn group. All of these profiles are listed in the order in which they appeared, Miller said.
Miller said that after months of filing a complaint and sharing fake profile information with LinkedIn, the social media network appeared to be doing something that caused the volume of group membership requests from fake accounts to drop dramatically.
“I wrote to our LinkedIn rep and said we were considering closing the group because the bots were so bad,” Miller said. “I said, ‘You should do something on the backend to prevent this. “
Jason Lathrop He is the Vice President of Technology and Operations at ISOoutsource, a Seattle-based consulting firm with approximately 100 employees. Like Miller, Lathrop’s experience fighting bot profiles on LinkedIn suggests that the social networking giant will eventually respond to complaints about non-genuine accounts. Meaning, if affected users complain loudly enough (posting about it publicly on LinkedIn seems to help).
About two months ago, Lathrop said, the employer noticed waves of new followers, and identified more than 3,000 followers who all shared different items, such as profile pictures or text descriptions.
“Then I noticed that they were all claiming to be working with us on a random title within the organization,” Lathrop said in an interview with Krebs on Security. “When we complained to LinkedIn, they told us these profiles don’t violate their community guidelines. But heck they don’t! These people don’t exist, and they claim they work for us!”
Lathrop said that after his company’s third complaint, a LinkedIn representative responded by asking ISOutsource to send a spreadsheet listing every legitimate employee of the company, and their corresponding profile links.
Shortly thereafter, the fake profiles that were not on the company list were deleted from LinkedIn. Lathrop said he still wasn’t sure how they would handle letting new employees into their company on LinkedIn in the future.
It is still not clear why LinkedIn appears Flooded with many fake profiles latelyOr how fake profile pictures are obtained. Random testing of profile pictures shows that they are similar but not identical to other pictures posted on the Internet. Several readers have pointed to one potential source – thispersondoesnotexist.com, which makes using AI to create unique headshots a point-and-click exercise.
cyber security company Mandiant (Recently acquired by The Google) Tell Bloomberg That hackers working for the North Korean government were copying resumes and profiles from leading job listing platforms LinkedIn and, in fact, as part of an elaborate scheme to get jobs at crypto companies.
Fake profiles may also be associated with so-called “Pig Slaughter” trickswhere people are lured by online flirtatious strangers to invest in cryptocurrency exchanges that eventually confiscate any funds when victims attempt to cash out.
In addition, identity thieves have been identified To masquerade on LinkedIn as employees for jobsand collecting personal and financial information from people who fall for recruitment scams.
But Taylor, the director of the sustainability group, said the bots that track them strangely don’t respond to messages, and they don’t appear to be trying to post content.
Taylor assessed, “They are clearly not being monitored.” “Or they are just created and then left to fester.”
This experience was shared by the manager of the DevOp group, Miller, who said he also tried to lure fake profiles with messages suggesting their fakes. Miller says he’s worried that someone could create a massive social network of bots for some future attack in which bot accounts might be used to amplify misinformation online, or at least distort the truth.
“It’s like someone is building a huge bot network, so when there’s a big message that needs to get out, they can just mass post with all these fake profiles,” Miller said.
In last week’s story on the topic, I suggested that LinkedIn take one simple step that makes it very easy for people to make informed decisions about trusting a particular profile: adding a “created in” date to each profile. Twitter does this, and it is very useful for filtering out a great deal of noise and unwanted communications.
Several of our readers on Twitter said LinkedIn needs to give employers more tools – perhaps some kind of API – that would allow them to quickly remove profiles that falsely claim to work in their organizations.
Another reader suggested that LinkedIn could also try offering something similar to a verified Twitter tag to users who chose to verify that they could reply to email in the domain associated with their current advertised employer.
In response to questions from KrebsOnSecurity, LinkedIn said it is considering the idea of domain verification.
“This is an ongoing challenge and we are constantly working to improve our systems to stop counterfeit products before they appear online,” LinkedIn said in a written statement. “We stop the vast majority of fraudulent activity that we detect in our community – about 96% of fake accounts and about 99.1% of spam and scams. We are also exploring new ways to protect our members such as expanding email domain verification. Our community revolves around real people having conversations. purposeful and always to increase the legitimacy and quality of our society.”
in A story published on WednesdayBloomberg notes that LinkedIn has so far largely avoided the scandals around bots that have plagued networks such as Facebook and Twitter. But that shine is starting to pay off, as more users are forced to waste more of their time fighting non-genuine accounts.
“What is clear is that LinkedIn’s profile as a social network for serious professionals makes it an ideal platform to lull members into a false sense of security,” Tim Kiplan Wrote. “Exacerbating the security risk is the vast amount of data that LinkedIn collects and publishes, which underpins its entire business model but lacks any robust verification mechanisms.”
“Infuriatingly humble alcohol fanatic. Unapologetic beer practitioner. Analyst.”