News for hackers. Stuff that matters.
Re:Who’s behind the “reopen” domain surge? by beirut_bootleg on Monday April 20, 2020 @08:20PM (#22930484)
There is already an ongoing and massive automated astroturfing campaign using hundreds of faked local news websites (news|times|standard|reporter|record|today.com) run by Metric Media, Locality Labs, Record Inc. and possibly others [1]. This reopen*.com wave is just more of the same, but I thank you for making the connection obvious to me.

There is also an ongoing crowdsourced investigation that is committed to exposing these misinformation campaigns that I'm sure would welcome your assistance [2].

[1] - https://github.com/MassMove/AttackVectors/blob/master/LocalJ...

[2] - https://www.reddit.com/r/MassMove/

Re:Who’s behind the “reopen” domain surge? by Balgair on Monday April 20, 2020 @11:59PM (#22931713)
Krebs links to a google doc in the article as well here: https://docs.google.com/spreadsheets/d/1k-GgWMNhg1se5302MCBh...

To note, Krebs has ~700 sites listed. Go ahead and ctrl+F for a city near you to see. The format of each of them is pretty cookie-cutter but the articles and pictures had a lot of work put into them.

For instance, here is one: https://metroeastsun.com/

Looking at this, I would never suspect that it was just a fraud. Looking at the headlines for the articles, it's pretty corruption heavy and seems to have a thing about government workers being paid, also a lot of white people smiling or pointing fingers while in suits. TinEye reports that the few photos that I bothered to check are all unique, whatever that may mean. Googling for lines in a few of the articles gets you back to that site and not others. Still, it's not even remotely out of line, just a bit odd when you look at it.

But we know it's not just odd, we know it's fake news. Even a bit of digging on the articles and photos points to it passing a sniff test. Without Krebs telling me that it stunk like a fish market, I'd never know.

Re:Who’s behind the “reopen” domain surge? by dtien on Tuesday April 21, 2020 @01:40AM (#22932317)
I checked a few links listed in that MassMove github repository around the Bay Area in CA, including:

  https://sanjosestandard.com/

  https://sanmateosun.com/

  https://sanfransun.com/
I wouldn't characterize these as fake news, they just appear to be massively automated sites generated from public press releases from local government. In several of the articles they list the byline as "By Press Release submission". So it appears they aren't trying to be too deceptive, and if you search the text from the articles is does link back to the actual press release from a real .gov site in that locality.

Also looking at the bylines from metric media news service itself ( just append /author/metric-media-news-service to the main domain ), I would have expected a more discernible pattern of articles biased towards a particular viewpoint, but again, I didn't see anything too nefarious.

So at first glance, it looks like a reasonable local site albeit very cookie cutter, and primarily regurgitations of press releases from local official govs. And at second glance, it doesn't appear to be much worse than that.

NOW having said all of that, I can easily see how this can be turned sideways very easily and quickly by the site maintainers. If you're actually able to build up a good readership with some of this 'basic' content, then come election time or some other critical moment where influence is important, you can easily seed more biased content into the articles. And these don't necessarily need to be blatantly 'fake', they can just be slanted a certain way. They could certainly go full bore and insert some really fake content in there once in awhile.

The sheer magnitude of it all is impressive, taken in isolation these sites would seem legitimate but seeing them all side by side and seeing the content laid out it becomes painfully obvious there's an ulterior motive to it all.

Thanks to the parent comment for making me ( and hopefully more of us ) aware of this type of activity.

Re:Who’s behind the “reopen” domain surge? by wtallis on Tuesday April 21, 2020 @02:38AM (#22932578)
> I wouldn't characterize these as fake news, they just appear to be massively automated sites generated from public press releases from local government.

That's just filler: low-quality automated content so that the site appears genuine at first glance. These sites are not intended to attract regular readership. They're a context into which propaganda pieces can be inserted and be linked to on social media. Readers are expected to hit the site only for specific articles, and to not be motivated to explore much further. If these sites were a genuine attempt to make money by peddling local news, they would have more ads and at least some mention of weather or traffic.

Re:Who’s behind the “reopen” domain surge? by holler on Tuesday April 21, 2020 @03:32AM (#22932833)
How do you know that the motives of the site operators are what you think? For instance it could be that this is a network of ad-revenue generating sites and has nothing to do with civil protest movements...

https://www.dw.com/en/disinformation-sites-generate-over-200...

Re:Who’s behind the “reopen” domain surge? by wtallis on Tuesday April 21, 2020 @04:45AM (#22933166)
The sites I've looked at simply don't have enough advertisements for that to be at all plausible. Ads on these sites are so sparse that it's eerie compared to legitimate news sites. Only a small fraction of the content on these sites is going to get any real traffic, and without a regular audience base the handful of ads spots they do offer are not going to bring in much money. I counted just three ads on the "Metro East Sun" homepage and only two on their current top non-bot story—one of those ads was from the Trump campaign.

And even if they do expect to turn a profit off these sites, the clear patterns in their non-bot content need to be explained. Why do all of these sites seem to be focused on mingling Republican propaganda with their filler content? Why not have some sites featuring clickbait for a different audience?

Re:Who’s behind the “reopen” domain surge? by pwg on Tuesday April 21, 2020 @10:40AM (#22935318)
If they are not going for ad revenue as you indicate above (sparse ads, at best) are they instead going for a huge number of "references"? I.e., do they feel (or have they A/B tested) that their miss-information campaign can be more convincing if their initial "contact" can cite a bunch of "references" that all seem to support the "issue" being pushed in that initial contact?

I.e., presume their real aim is some kind of initial email contact, possibly soliciting donations/support for some 'cause'. If that contact email can reference ten of these fake websites, all of which support the point made in the initial email, does it increase the rate of donation/support return from that initial contact email?

Re:Who’s behind the “reopen” domain surge? by wtallis on Tuesday April 21, 2020 @01:13PM (#22936944)
A lot of the non-bot content seems to be fairly local stuff: hit pieces against local Democrats or praise for local Republicans. The underlying issues are similar, but the articles themselves don't seem to lend themselves to being aggregated in that manner. Plus, it doesn't seem like a good idea to try to present a false consensus when all the sites you're linking to look like the same site.

And I highly doubt that they're focusing on email as the means of reaching new users. This clickbait is meant to spread via Facebook posts.

Re:Who’s behind the “reopen” domain surge? by pwg on Tuesday April 21, 2020 @02:15PM (#22937691)
> hit pieces against local Democrats or praise for local Republicans.

This suggests another possible reason. Those behind them have found that if the 'fake' site appears to be 'local' enough, it will be seen as more reliable and/or it is more likely to get "liked" (given your "spread via Facebook posts"). Possibly their A/B testing has shown that fake 'local' stuff gets more spreading on FB?

Re:Who’s behind the “reopen” domain surge? by wtallis on Tuesday April 21, 2020 @04:30PM (#22939021)
I don't think that's "another" possible reason so much as you're closing in on the original accusation. The reddit group linked upthread refers users to this article explaining these sites: https://www.nytimes.com/2019/10/31/upshot/fake-local-news.ht...

All you're missing out on at this point is the obvious partisan motivation.

Re:Who’s behind the “reopen” domain surge? by Kaiyou on Tuesday April 21, 2020 @08:38AM (#22934381)
Can we just take a moment to appreciate that a sites legitimacy is questioned because the site isn't crippled by ads to the point of being nearly unusable? That's a really unfortunate state of affairs. Especially since I don't think small sites trying to build an audience can afford to cripple themselves to the same degree with ads as bigger sites can.

One reason I can think of for increased Republican content is because of outrage economics. They tend to generate more clicks. It's also something that isn't catered to by the big news networks. Smaller sites I'm regularly visiting for over ten years have also shifted in this direction and those type of articles always generate more comments than other ones, so the tactic seemingly works.

Re:Who’s behind the “reopen” domain surge? by beirut_bootleg on Tuesday April 21, 2020 @02:40AM (#22932588)
> I wouldn't characterize these as fake news, they just appear to be massively automated sites generated from public press releases from local government.

Correct. Some are completely automated using state/county filters of public APIs, while others are word for word scrapings of Facebook posts from relevant local groups.

> NOW having said all of that, I can easily see how this can be turned sideways very easily and quickly by the site maintainers. If you're actually able to build up a good readership with some of this 'basic' content, then come election time or some other critical moment where influence is important, you can easily seed more biased content into the articles.

Already happening. Besides the automated posts there is also what appears to be original content written by professional content writers. Some of the websites listed in the spreadsheet will only have automated posts as you've found, but look further and you'll see closer to a 50/50 split on the sites for some of the larger cities. What's more concerning here is that some of these authors are submitting their work to sites in completely disparate areas, and own accounts on all of the websites even if they don't write there.

> The sheer magnitude of it all is impressive, taken in isolation these sites would seem legitimate but seeing them all side by side and seeing the content laid out it becomes painfully obvious there's an ulterior motive to it all.

My understanding of this original content from some of the MassMove discussions is that it's trying to build public opinion where there is none to eventually get laws pushed and signed - so effectively astroturfing.

Re:Who’s behind the “reopen” domain surge? by potench on Tuesday April 21, 2020 @04:13AM (#22933018)
I imagine these sites need to look/be legitimate in order to be approved to buy advertising on FB. Automating them from press releases is a cheap way to do that. FB does some rigorous checks on ad-sets - I’ve had to honeypot their process to debug why on earth they kept rejecting a site (was an automated scraper flagging it? Or was a manual reviewer rejecting it after clicking around? Was the content, user experience, or something else in violation of FB ad policies?): https://facebook.com/policies/ads

Anyways, if these sites want to buy advertising on FB they need to pass this scrutiny. Would be curious to see which urls/content on these sites MassMove sees as nefarious. What landed these sites on the list?

Edit: Oh I see, there’s a short list of site operators.

Re:Who’s behind the “reopen” domain surge? by mentor20 on Tuesday April 21, 2020 @04:58AM (#22933217)
This content was seen as nefarious:

https://www.reddit.com/r/MassMove/comments/fzunwk/caught_a_d...

They were running ads by LGIS on Facebook for that specific Corona story: https://www.facebook.com/ChicagoCityWire/posts/8442905359819...

Rush Limbaugh's quotes the article ChicagoCityWire.com:

https://www.rushlimbaugh.com/daily/2020/04/10/two-stories-in...

And the ads got people to post the article to reddit repeatedly: https://www.reddit.com/r/MassMove/comments/g0icy3/rmassmove_...

Re:Who’s behind the “reopen” domain surge? by jvanderbot on Tuesday April 21, 2020 @11:31AM (#22935806)
Using automated tools to bring easily-scraped news to people is a good way to enure deniability and keep an audience around. Aggregators are wonderful homepages. Then, occasionally, you can (either by accidental scrape or design), push highly biased content that is provably false, and it will be a subtle signal in innocent-seeming noise.

Not saying that's what's happening here, just saying that an abundance of innocuous content does not make a site unbiased and trustworthy, just as it does not make it immediately suspicious.

Re:Who’s behind the “reopen” domain surge? by mometsi on Tuesday April 21, 2020 @07:08AM (#22933819)
Looks like they used the bootstrap.js blog example as a template-- compare with https://getbootstrap.com/docs/4.4/examples/blog/

I see tracking via facebook, linkedin, quantcast, matomo, and locallabs.com, and user monitoring via newrelic js-agent.

Re:Who’s behind the “reopen” domain surge? by Balgair on Tuesday April 21, 2020 @11:23AM (#22935713)
> I wouldn't characterize these as fake news, they just appear to be massively automated sites generated from public press releases from local government.

In googling a few lines here and there in the articles, I couldn't find a way back to other content. I'm not saying they aren't using other documents as the seed for an article, but the writing appears to be unique upon a quick gut-check. Additionally, the photos appear to be unique as well. Again, super quick checks on my part.

To me, that means these things fit the bill of 'fake news' perfectly [0]. Maybe it was a very good bot that wrote the articles with a very good GAN image creator, maybe it was a mechanical turk that wrote them for ~$0.10. I don't really care. To me, it's fake news.

[0] Per Webster's: "False stories that appear to be news, spread on the internet or using other media, usually created to influence political views or as a joke"

Re:Who’s behind the “reopen” domain surge? by 0x138d5 on Tuesday April 21, 2020 @07:50AM (#22934054)
When opening metroeastsun.com one is greeted with the following:

>Help us continue our fight against cronyism, corruption and profligate government borrowing & spending.

Well okay then.

2 things stood out for me which raised questions as a non-American.

1) The quality of the site - are the websites of local US papers usually this decently made? Even if it's just a random WP theme. I was under the impression that they were still perpetually 10 years behind the curve. See https://www.fredericknewspost.com/ for example.

2) The real estate section looks fishy as all hell. Why would they include something like that?

Re:Who’s behind the “reopen” domain surge? by Balgair on Tuesday April 21, 2020 @11:14AM (#22935615)
As to 1), yes, this is about par for the course. Most local news sites are of near this quality.

As to 2), I've no clue. Maybe they are scraping the MLS feeds or Redfin's site in order to appear more legitimate. Honestly, it does feel more legitimate to me as real estate is very serious business. Fake news of c. 2016 didn't have a real estate section per my remembering of them.

Re:Who’s behind the “reopen” domain surge? by pstuart on Monday April 20, 2020 @10:06PM (#22931145)
Thanks for the links, this is good stuff!