Election Buster is an open source tool created in 2014 to identify malicious domains masquerading as candidate webpages and voter registration systems.
During 2016, fake domains were used to compromise credentials of a Democratic National Committee (DNC) IT services company, and foreign adversaries probed voter registration systems. The tool now cross-checks domain information against open source threat intelligence feeds, and uses a semi-autonomous scheme for identifying phundraising and false flag sites via ensembled data mining and deep learning techniques. We identified Russian nationals registering fake campaign sites, candidates deploying defensive—and offensive—measures against their opponents, and candidates unintentionally exposing sensitive PII to the public.
Electoral candidates from both sides of the aisle increasingly rely on the internet to promote their brands and to focus the message of their political platforms. Yet cyberspace isn’t safespace. How do voters know they’re viewing a candidate’s real website? How can voters ensure their online donations are actually going to a specific candidate or cause? Election cybercrime is a burgeoning area but little data exists on the size and scope of these unscrupulous activities. Election Buster is an open source suite of tools to begin to measure the scope of this problem and used it to scan every single candidate running for the house and senate (1000+ candidates)in the 2014 General Elections. We’re continuing development and using it to scan the 2018 election.
This tool scans the URLs, and associated typos, of candidate election pages. This is done in an attempt to identify typosquatters. The time the tool takes to run is highly dependent on multiple factors, but the two most important factors are length of the candidate’s name (and state) and the type of network medium the tool is run over (i.e., wired or wireless). Wired connections often take about 30 minutes to an hour to complete, while wireless connections cause the program to finish in around 8 to 10 hours.
Example types of candidate URLs it looks for are:
- joshfranklin.com
- josh2014.com
- franklin2014.com
- joshfranklin2014.com
- joshforpresident.com
- josh4president.com
- president-josh-franklin.com
- presidentjoshfranklin4president2014.com
- presidentjosh-franklin4president2014.com
