Hack back series how to spot fake linked in profiles - a way to figure out false social media network requests v0.2

Hack Back Series:
HowtospotfakeLinkedIn
profiles
AWaytofigureoutfalsesocialmedianetworkrequests.
By 404Whylo
27April,2015©2015www.404Whylo.com™Allrightsreserved.
1

Summary
2
• Hack back series is all about YOU and how I can contribute to
make the internet a safer place for everyone.
• LinkedIn Forensic for the standard user. I like to guide you
through a forensic approach to check for false profile pictures
and false profiles on LinkedIn .
• The techniques you learn will are essentials skills now and in
the future.
• More and more you will have to do this in the digital world
since attacks, scams and scum bags are upsizing their attack
intelligence.
• Protect yourself and become more diligent in the use of digital
media.

Howtospotfakeprofiles
• Based on the shear amount of fake profiles who try to invite
you to their LinkedIn network I decided to create this short
practical guide on how to spot fake profiles.
• In a previous article I wrote about the detection of a false
linked profile photos. You might read this one as well.
• http://www.slideshare.net/slideshare807am/hack-back-series-how-
to-spot-fake-pictures-a-way-to-figure-out-false-social-media-
network-requests-v02
• Based on a recent real life LinkedIn request I will show you
some tricks in spotting fake profiles very easily.
• Follow the steps and try it out yourself.
3

Theprofileoftherequest
• I got this LinkedIn
request just recently.
• First I read the profile and
decide weather this
request is somehow
phishy. I look at the
photo, the employer, work
experience and history
etc. All this gives me
indicators of legit or fake.
• First action I take is
always check for the
photo with Google or
TinEye.
4
©2015www.404Whylo.com™Allrightsreserved.27April,2015

First–thephotocheck(google)
• Right click on the
profile picture and
click on «Search
Google for this
image» or,
• You can use Tineye
for this too (will be
described later).
5

GoogleresultsI
6
As you can see the
picture is all over the
place (internet), the
exact same picture is
related to multiple
sources.
Pick some of the sites
go there to check
them out. Dive
deeper.

GoogleII–divingintoasite
7
It looks like the contact person works in advertising as well . Her
recent advertising campaign maybe works as a good conversation
starter. •www.allegromedical.com/attr-condition-Hemorrhoids.html

GoogleIII–divingintoasite
8
https://www.sccfcu.org/careers/

GoogleIV–divingintosites
9
contemporary-dental.com/
www.goodsource.com
shadeyladies.com
/testimonials

Picturesearch-conlclusion
• The picture search revealed:
• The profile picture is widely available on the internet. 
A legit person can be available widely too but would be related to one
name.
• The picture is associated with many unrelated sources and
names. A legit person would normally always be associated with
his name but maybe different with organisations and places.
• Conclusion: The profile picture of your contact request is
related to too many different persons and sources. This
makes it highly unlikely that this picture is real, rather it has
been snatched from one of the sites Google found. Most
often pictures get snatched from free picture sites like stock
photos.
10

First–thephotocheck(tineye)
• First go to the profile picture:
• Then right click on the profile
picture and select “Copy image
URL” After that open a new
browser window for
http://www.tineye.com/ There
you can paste the image URL in
the ENTER image Address box
and click search .
11Just to let you know I am in no way affiliated with http://www.tineye.com/ nor
do I get any incentives, endorsements etc. etc. It’s a tool and it’s free and it
works. It helps to protect you so just try it at your discretion.

TinEyeresults
12
As you can see the picture is
all over the place, the exact
same picture.
Conclusion: this cannot be a
picture of a real person
therefore you should not
connect with this person

TinEyeresults–sourcetracking
• TinEye offers the possibility to sort for the «oldest» picture.
• This is great for source attribution. Compare the date of the
LinkedIn profile creation to the date of the «oldest».
13

Second–checkemployerI
• Second you should check the employer of the
person requesting to be your contact. So you
can see who your contact is working with and
who else eventually works at the same place.
• You can do this in two ways:
• Click on the current employer or
• Use google based on the company name
from the profile
14

Second–checkemployerII
15

Second–checkemployerIII
• Oh no one else
works there!
Must be hard
being an HR
Manager at a
company no
one works for.
16

Second–checkemployerIV
• Google check.
Oh no!
• There is no
such company
to be found by
Google.
17

Employersearch-conclusion
• If the person requesting your contact has no co-
workers this is suspicious. Especially if the person
requesting contact claims to be a senior executive
or manager or assuming a role of authority like
Police, Fire brigade, Military then the person must
work in a known company and will have co-
workers (connected to him or not).
• If the Company does not exists based on a search
with google I would be very wary about the
legitimacy of the provided credentials. 18

Hm…
• These quick checks revealed enough to definitely
reveal this connection request as fake (profile
picture, employer etc.)
• Delete and forget!
• But I want to show you what more can be done if
you are uncertain about the legitimacy of a
profile or just plain curious ;-)
• Next step in LinkedIn Forensics…
19

Theprofilecontent…
• Often content of fake profiles is shallow has next to no
recommendations and the employment history is short.
• Maybe only two or three employers. Senior professionals with
experience usually have more but the laziness of these profile
creators work to your advantage.
• Experimental Forensic: analysing the content can be also very
insightful. You can do this with professional tools or just with
Google.
• Google works fine and fast for some quick content checking.
• The plan is to check for some of the profile content to see if it
has been plagiarised or copied from somewhere else.
20

Theprofilecontent–checkI
• I took parts (blue
marked) of the
description from the
profile of the person
requesting your contact.
• I feed that text snippet
into Google and just hit
search…
• Experiment with less or
more text in order to get
different/ better results.
21

Theprofilecontent–resultI
• Surprise, surprise I
landed some hits!
• One person had
multiple hits.
• Next I went to this
persons LinkedIn
profile to see what
the hits where about.
22
Masked for privacy
Masked for privacy
Masked for privacy

Theprofilecontent–compareI
• The two profiles summaries side by side
23
Assumed fake Assumed legit
Masked for privacy

Theprofilecontent–firstresult
• Obviously the content has entirely being copied
over from an appearing legit LinkedIn user.
• 1:1 copy thank you, laziness has prevailed.
• Now think about what will happen if the fake
profile builders aren't that lazy anymore?
• Now I got curious even more. Could there be
more?
• I did more content search starting form the
assumed fake profile.
24

Theprofilecontent–checkII
• I took parts (blue
marked) of the
description from the
profile of the person
requesting your
contact.
• I feed that text snippet
into Google and just
hit search…
• Experiment with less
or more text in order to
get different results. 25

Theprofilecontent–resultII
• Surprise, surprise I
landed some hits!
• One person had
multiple hits.
• Next I went to this
persons LinkedIn
profile to see what
the hits where about.
26
Masked for privacy
Masked for privacy
Masked for privacy

Theprofilecontent–compareII
• The two profiles summaries side by side
27
Assumed fake Assumed legit (second person)

Theprofilecontent–2ndresult
• Obviously the content has entirely being copied
over from an appearing legit LinkedIn user.
• 1:1 copy thank you, laziness has prevailed.
• Now think about what will happen if the fake
profile builder aren't that lazy anymore?
• Now I got curious even more. Could there be
more?
• I did more content search form the assumed fake
profile.
28

Diggingintosecondperson
• The fake profile requestor copied content
from two different profiles and uses a fake
profile picture.
• Something on the profile of the second
person our contact requestor copied from
made me suspicious.
• So I did what I already explained to you.
• Using Google to check for copied content.
• …
29

Inputfromsecondperson
• Here the text snippet I took
form the second person our
original scammer took
information from.
• That person presented
himself working from Sept.
2003 to March 2014 for
Network Rail in
Manchester.
• So far so good
• Exactly take text put into
google and see…
30

Resultfromsecondperson
• In a job ad from
railwaypeople.com I found
the exact same text.
• Now what does this mean?
• There is no coincidence.
• My gut tells me this is a glitch
from a young professional
wanting his LinkedIn profile
look professional.
• So he copied some text over
in order to pimp his profile.
• Good he is not into security
otherwise this could lead to
questions later (depending on
his future employer). 31

Case
32
A
BQ C
D
1. (A) Stole:
1. Profile picture (Q)
2. Job Summary from (B)
3. Job description content from (C)
1. C stole Job description content from (D)

Summary
• Be very vary who you connect with.
• Hone your skills in detecting fake or
fraudulent credentials, skills and
profiles.
• Be always diligent.
• If you have the slightest doubt then
don’t connect. 33

Thanksanddon’t
forget tohave
fun!
34

Hack back series how to spot fake linked in profiles - a way to figure out false social media network requests v0.2

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (10)

Similar to Hack back series how to spot fake linked in profiles - a way to figure out false social media network requests v0.2

Similar to Hack back series how to spot fake linked in profiles - a way to figure out false social media network requests v0.2 (20)

More from Reputelligence

More from Reputelligence (20)

Recently uploaded

Recently uploaded (20)

Hack back series how to spot fake linked in profiles - a way to figure out false social media network requests v0.2