Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Ghost Followers - Using AI to Unmask Fake LinkedIn Profiles at Scale

Harish Elavia

Where

Packet Hacking Village
DEF CON 34

Duration

29 min

Shows how fake LinkedIn profiles can be spotted by combining image forensics, behavioral signals and network graph analysis into one score.

Summary

The talk opens with the scale problem. LinkedIn has more than a billion profiles, and a fake account can be created in under a second, far faster than manual review can keep up. The speaker describes how fake profiles probe users for work and personal details, so they serve as a route to social engineering as well as phishing.

The core of the talk covers three signal families. Image forensics looks for GAN-generated headshot artifacts such as mismatched eye reflections, asymmetric accessories, and images reused across profiles, found through reverse image lookup. Behavioral checks flag impossible histories, overlapping jobs, templated profiles copied across many accounts, and LLM-style text. Network analysis asks whether a profile's connections make sense for its stated field. Each family produces a score, and a fusion step combines them into a calibrated verdict. A live demo ran a synthetic profile and a genuine one through the pipeline.

The speaker stresses that scores are leads rather than verdicts. Low-confidence cases should go to a human reviewer to limit false positives, and the system should never auto-ban or publicly accuse anyone. Takeaways include not relying on a single indicator, calibrating scores, and keeping people in the review loop. During Q&A, email pattern detection was raised as a gap, since fake accounts can use plausible-looking addresses.

Materials

Related talks