We ran across an automated account by the name of @alllibertynews recently as a result of it having voluminously retweeted another account we were studying (@reality3232.) How does the automation work, and can we find other accounts using the same tools?
cc: @ZellaQuixote
cc: @ZellaQuixote
@alllibertynews @reality3232 @ZellaQuixote Almost @alllibertynews’s most tweets are posted by automated means. Mostly, they’re retweets, but a few here and there begin with the text “@labnol testing twitter connection”. A quick search turns up other accounts with this same tweet, which contains a link to a blog post... 
@alllibertynews @reality3232 @ZellaQuixote @labnol The blog post is titled “How to Write a Twitter Bot in 5 Minutes” but would be better titled “if you give me access to your Twitter account, Google account, and Twitter Developer API keys (TOS violation), you can automate your Twitter account with my app.” #ThatsAHardNo
@alllibertynews @reality3232 @ZellaQuixote @labnol Apparently such opsec concerns didn’t deter everyone, as we found 173 current or former users of the app in question by searching for “@labnol testing twitter connection”. (The signup website is digitalinspiration(dot)com so we’ll refer to the app as “Digital Inspiration”.)
@alllibertynews @reality3232 @ZellaQuixote @labnol The “Digital Inspiration” accounts don’t form a single botnet - most of the accounts appear to be solo projects/small groups of accounts that found and signed up for the tool independently. We’ll add observations on any we find particularly interesting to this thread as we go.
@alllibertynews @reality3232 @ZellaQuixote @labnol Looking at the creation dates of the accounts automated via the Digital Inspiration site, we see a definitive spike in June 2016, which is often a sign of batch creation of accounts by a single operator.
@alllibertynews @reality3232 @ZellaQuixote @labnol The spike in question is a botnet consisting of 35 accounts with multiple similarities: recurring phrases in bio, cat-on-keyboard strings of randomized characters in the app names, most use Hootsuite in addition to Digital Inspiration, and all are dormant since early 2018.
@alllibertynews @reality3232 @ZellaQuixote @labnol The primary mission of this botnet appears to be to link techcrunch(dot)com, judging by what the accounts link. Hashtags are mostly related to tech and social media marketing.
@alllibertynews @reality3232 @ZellaQuixote @labnol Another method for identifying botnets lurking in a larger group of accounts: look at which accounts tweeted identical tweets. The techcrunch set described earlier is the only large network this reveals in the "Digital Inspiration" set, although a few 2 account botnets show up.
