This article intends to discuss the concept of sock puppets. What are sock puppets account, why would you need to use them during OSINT, and perhaps most significantly, how do you set them up? Let’s get the ball rolling.

What’s SockPuppet Account?

Simply put, a sock puppet is an alternative profile usually, a social media profile, which you create intending to gather open-source information, with the restriction that this profile will not link back directly to your original account.

Edd Gent says in a New Scientist article about what researcher Srijan Kumar, of the University of Maryland, said,

“In the era of fake news, detecting sock puppets is important. Whenever the same party uses multiple accounts, it is harmful, and it skews the discussion, and fake news can be propagated very confidently”.

What are the Sock Puppet Functions?

Sock puppets have two significant roles: utility and security.

Utility

Creating a specific social networking profile for the sake of collecting information makes logic from a utility perspective. Either you are aiming to befriend anyone on LinkedIn, seek to friend anyone on Facebook, or follow someone on their personal Instagram profile, you may want to make a more appealing profile to the individual or company you’re investigating. So, from a utility point, creating a new identity for the sake of your investigation is a no-brainer.

Security

Sock puppets are also handy from a security perspective. Making up an alternative profile that does not explicitly link back to you is just neat OPSEC. If you are investigating an individual or organization, you likely do not want them to realize who you are or that you’re probing into something. During investigations, sock puppet offers anonymity as well as OPSEC to both the investigator and the victim.

Pre-questions of Sock Puppet

If you do a bit of pre-work, creating up your profile will be a lot simpler, and the result will be far more efficient. I would like you to think about anonymity and persistence.

• Do you require complete anonymity on that profile? However, when I say anonymous, I am referring to the fact that a sock puppet does not usually lead back to you, but it might. You must make this profile in such a manner that it is anonymous, so that no matter how much a corporation investigates, they will most likely not be able to trace it to you.
• A persistent profile is simply a fictitious character you create to communicate with others on social networking sites. For days, months, or even seasons, you will be building contacts on LinkedIn, following personal Instagram profiles, or invading social networking sites, and that is a constant activity. You will need to do a great deal of research to establish this profile in such a manner that it will meet your objectives. Investigating publicly accessible assets is much effective with a persistent profile.

How to Setup Sock Puppet Account?

If you adopt this step-by-step method to produce sock puppets, you’ll not only be able to make your profiles now, but you’ll also understand to make them in the long run.

Persona

Create a character for the sock puppet profile. Prepare at the very least the following:

• Name / Age / Gender

Create a character with a Fake Name Generator that meets your sockpuppet persona.

• Image

To render an image, use This Person Does Not Exist. Be sure to assess the picture carefully and choose one that does not have any apparent defects, as they always do. Use Photopea right in the browser if you need to modify an image.

Password Manager

You’ll have to fill out a bunch of “me” information while creating new profiles. Like names, passwords, contact information, dates of birth, identification questions, and other personal details. Password managers that are open-source software, such as Bitwarden or KeePassXC, will help you keep a record of everything.

Burner Phone

Buy a burner phone that has been clean and is ready to use. It’s nearly difficult to make a profile these days without getting a non-VOIP mobile number. Purchase a low-cost mobile to use it as anonymously as necessary.

SIM Card

A new SIM card provides you with separate contact details. Mint Mobile’s 7-day trial on Amazon is the cheapest SIM card. If you make a new profile, register with a privacy.com  disguised credit/debit card, and get it delivered to an Amazon locker, you can order it anonymously.

Access Wi-Fi

Do not access your own house or workplace Wi-Fi with an actual IP address. You can’t choose a VPN because it will almost certainly stop you from making a profile. Pick a good location like a library that is not directly beside your home but is near enough.

Email Account

Create a primary email address. You can set up other email accounts afterward, but you’ll want to start with a single main email account to which you will configure everything. I propose creating a Google account and a Protonmail account at the very least. Both are useful at various periods.

Setup 2FA

Set up 2FA on all of your profiles. Where at all necessary, use a hardware device like the YubiKey.

VOIP Number

Switch the contact information to the one you have more direct access to, such as MySudo or Google Voice, once you’ve configured 2FA for all of the profiles.

Steps to Configure Sock Puppet Accounts

You have got all to make profiles on Facebook, Twitter, LinkedIn, Instagram, and other social media sites. Take time to set up each profile from beginning to end, storing all of the details in your password manager in the following order:

• Create the account (Use public Wi-Fi instead of a VPN with new contact details).
• Once you create a profile, head straight to the security and privacy options.
• Swap Mint mobile number with VOIP number.
• Configure 2FA, ensure everything is in working order, wipe the mobile and ruin the SIM card.

Final Thought

The approach is similar to that of creating a standard social media account. Except that you’re attempting to circumvent any automatic or built-in tests that the social media site might have in place that could flag everything we’re performing. OSINT gathering is a science and a craft. The craft aspect of the model is high emphasis when it comes to set up socks. You may have to do a few various things to get it to succeed. And I am not going to lie: what works now will or may not work tomorrow.