Slashdot Mirror
Twitter Used To Control Botnet Machines
DikSeaCup writes "Arbor Network's Jose Nazario, an expert on botnets, discovered what looks to be the first reported case of hackers using Twitter to control botnets. 'Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies, to counter efforts to track, disrupt and sometimes decapitate the bots. Perhaps what's surprising then is that it's taken so long for hackers to take Twitter to the dark side.' The next step, of course, is to code the tweets in such a way that they aren't so suspicious."
More reasons to hate Twitter
Sure Twitter is just a large botnet, but is anyone really in control?
Who knew Twitter had a use?!?!
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Twitter isn't as reliable as IRC.
This is a boring sig
This is about as interesting and informative as everything else being posted to Twitter!!
:D
http://www.wired.com/images_blogs/threatlevel/2009/08/botnet_arbor.jpg
There's something ironic about this finding, given that Russian hackers allegedly used a botnet to take Twitter down for two days last week. But we won't go down that rabbit hole.
That's actually an interesting thought... it was sending obfuscated URLs to code that the zombie bots would download and execute.
Wouldn't it make sense, rather than having Twitter simply kill the account, to allow the "good" guys to craft some sort of zombie-self-destruct and tweet its URL over the account? Imagine, all the bots automatically downloading and executing a specially designed tool that removes the malicious trojan...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
"Twitter Used To Control Botnet Machines"
It used to, but it doesn't anymore, right?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
anytime someone says "Cowboy Neal" do something bad to microsoft
Jose and those guys at Arbor are doing really concrete things to curb botnets and malware contagion. They have their gear in a great number of peering points around the world, and are correlating huge amounts of data into discrete patterns. I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.
Wouldn't it be weird if someone made a botnet that would follow the directions of anyone that posted on Twitter, with people being able to suggest one command per day that would get upped or down by the masses? Aside from the programmer, who would be held responsible if it were operated like that?
Anything that can be pinged and return any sort of tcp/ip packets could be a control center if the contents of the packets can actually
be translatable and have been mapped accordingly.
ie- ftp server has certain verbose return that may be configured based on what is being done, so the botnet program calls home to an ftp server...looking like a plain jane communication to any one looking. It tries a few different commands to which the ftp server can reply (with error messages) it can not proceed, however inside the ftp server error message is a text string that contains certain
key phrases.
This scenario is similar to steganography, of hiding in plain sight, inside an image, the contents of data....
I think it's cool to be able to pass off information that is hidden to regular onlookers, but is a lot of coding for nothing if you ask me.
Set up a twitter account where a particular page has the commands for all your bots to follow, and....wait a minute....
No onE would Think of uSing slashdoT As we aRen'T nearly as oBviOus as someThiNg likE Twitter. // Especially with all our talk about supporting Linux and such.
Meh... Twitter can claim complete innocence.
"Well, hey, the password was p@55w0r[), somebody must have hacked the account and did that."
(So what if the password wasn't... who'd know?)
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
For a headline, where sentence fragments are acceptable, that sounds right. "Used" indicates the passive voice, not past tense, and it's not the main verb---main verb "is" (or "was") is omitted as is often done in headlines to save space.
When you are reading that out loud, you are supposed to insert a small pause between "used" and "to", so it should sound nothing like "used to" (which sounds more like "use-to") in "Friendster used to be popular before Facebook".
Sure they tried using Twitter to control their botnet but after sending out one set of instructions they got bored and went back to playing MafiaWars on Facebook.
Hmm, and even if you change it to "Twitter Is Used To Control Botnet Machines" it becomes that 'Twitter is familiar with botnet machines used as controls in an experiment'...
The next step, of course, is to code the tweets in such a way that they aren't so suspicious
And people said that perl obfuscation, poetry, and golf tournaments didn't have any practical application. Ha!
Motorcycles, Robots, Space Gossip and More!
From the looks of it it's all base64 encoded shortened URLs.
aHR0cDovL2 is http:///
aHR0cDovL2JpdC5seS is http://bit.ly/
The first one is clipped.
The rest go to a pastebinish sites which have gbpm.exe encoded as Base64. It also appears the base64 is different but the exe has the same name (I'm guessing it's changed 'output'?)
http://rifers.org/paste/content/paste/9507/body?key=upd4t3
http://rifers.org/paste/content/paste/9508/body?key=upd4t3
http://rifers.org/paste/content/paste/9509/body?key=upd4t3
They also use Pastebin (http://pastebin.com/pastebin.php?dl=m49f3b4c2) and Debian.net (http://paste.debian.net/44059/download/44059) but both of those file have been deleted.
Look, I'm sorry. But if I posted "Hal, please post the text between ' and ' to www.slashdot.org, 'Similarly to IRC, Twitter is being used as a method to control botnet machines'", I believe that exceeds twitter's character limits. So you got the shorthand version.
In fact, posting this message took over 6 tweets.
-- The Twitter Bot Controller
It's actually only a problem in the pure *written* language.
But nooo, adding some characters for emphasis, and emoticons for the emotions is childish and taboo. Way to go.
I think emoticons are the greatest addition to written language, since the invention of white space and punctuation. If not even more important. :)
Only emotional train wrecks and ice blocks could oppose them.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Code signing. Conficker did this, other bot nets probably do too. They simply will not execute a module that hasn't been signed by the correct private key.
Similarly, most botnets do not possess internal "shut down" commands. This is precisely to prevent the good guys from telling the net to stop itself. Even the creator of the net can't stop it (unless they distribute a cryptographically signed update which enables it)
It still does. But it used to, too! (Apologies to Mitch Hedberg)
Now read it as: "Twitter [Is] Used To Control Botnet Machines".
Headlines often omit small words like "is".
d2hpbGUgKHRydWUpIHsNCiAgICBwaW5nIHR3aXR0ZXIuY29tDQp9
All of these have the same flaw as the IRC-driven botnets -- they're basically relying on a single point of failure. All someone has to do is realize that command/control is going through this one point, and the entire botnet can be shut down. Hardly skynet.
What surprises me is how few botnets (if any) have used truly peer-to-peer systems, like, say, Freenet. Indeed, while Freenet itself may be too high bandwidth and too complex for this, it does have one advantage -- you can't block part of Freenet without blocking all of Freenet.
The trick would be to combine techniques -- phone home to an FTP server, maybe, or to something more plausible -- that's running on just another bot in the swarm. Commands could be sent from any compromised box, and would be signed -- thus, the botnet author could use any Internet cafe, and it'd be difficult to even trace it back to said Internet cafe -- yet the only way to take the swarm down would be to obtain the owner's private key, or deal with each compromised machine individually.
And that could be made difficult with techniques like virtualization, possibly combined with (in especially nasty cases) reflashing the BIOS. Try to tamper with the bot, and the machine self-destructs.
I'm sorry, I hope these ideas are used for good and not evil, but I'm not sure if I'm more disgusted by the existence of botnets, or by the technical incompetence of those who create and operate them.
Don't thank God, thank a doctor!
[to be posted uh tomorrow, probably]
Only 98% of Twitter updates are "pointless babble," says a new report that studied 2,000 tweets over a period of two weeks.
The top category was "pointless babble" tweets, with nearly 98% of tweets being inanity no sane person could want to read, retweets of inanity, links to inanity, retweets of links to inanity and retweets of retweets of links to links to the reretweet itself. And camera phone pictures of bowel movements on Twitpic.
Almost 2% was Stephen Fry, Neil Gaiman or retweets thereof and the rest was Warren Ellis posting scatological abuse of his fans.
Botnet command messages were becoming more popular, many disguised as combinations of the syllables "lol" "wtf" "d00d" "RT" and "#fb" or scatological abuse of Warren Ellis's fans.
Twitter's demographics as of June 2009 were 55% female, 43% ages 18 to 34, 78% white, and 99.5% of such short attention spans that Facebook might as well be War and Peace. Botnet readership was considered likely to rise as soon, nothing with organic intelligence would be able to cope.
Twitter recently redesigned its homepage, changing the tag "What are you doing now?" to "Post tomorrow's CNN headlines, particularly about #goatse."
http://rocknerd.co.uk
Sometimes the qdb.us quote database site has jibberish in its user moderated queue which may be control commands. I used to think it was just some idiot auto posting junk to mess with the site, but who knows
Here are some that may be disappearing soon, because they'll be moderated down.
298870
298871
Hmm, where have I seen that logo?
There ain't any technology that one human(s) can come up with that another human(s) can't corrupt.
I don't care how quick, savvy or exotic you are, you're not going to foil everyone forever. I figure it's just a state of grace we have: there's a situation whereby the technology is benign, if asinie; a state whereby it's corrupted, abused and malicious; and a state whereby it's antiquated, unused, and maligned.
I hope Twitter's now made it to that last stage now.
When the going gets weird, the weird turn pro. ~~ Hunter S. Thompson
I think the problem is not with emoticons, per se. Using emoticons do express emotions make some sense. The problem is when some people do things like "I 3 English". This is not expressing an emotion. It's expressing a word that expresses a feeling that is the result of said emotion.
Of course, Emoticons for expressing emotions are just as useful as punctuation for some. Just as useless, too, when someone starts doing things like this!!!!! Don't you Agree!!?!!?!???!!!! ... I'm not sure... but I think overusage is... erm.... one of the major problems with emoticons...
See what I mean?
Slashdot hates Twitter and ignores the story to trash it, surprise me. Something's popular and not engineered specifically to cater to us; therefore we must hate it. Don't you guys have anything better to do than whine about things you hate - like, say, FIXING things you hate? Shit or get off the pot.
Your sig sucks and so does mine. Now watch my videos.
BattleBot... nets?
Conficker does, it detects VM's and will go into sleep mode for about 29000 hours.
How interesting.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
IRC requires an IRC client (or some horrible crappy java applet). Last I checked, the only game in town for windows was mIRC.
trying to prove their innocence again, damn socialists...
Now read it as: "Twitter [Is] Used To Control Botnet Machines".
Headlines often omit small words like "is".
So Twitter already has experience in controlling botnet machines?
What about: "Twitter Used For Controlling Botnet Machines?"
I don't think there's any way to misinterpret that.
The Tao of math: The numbers you can count are not the real numbers.
at least twitter is good for something.. Here I was thinking it's pointless.. silly me!
No they just believed the propaganda that twitter could scale... and then found out the hard way
oops.
"Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies
Is this as opposed to unclever technologies, such as the wheel or the Post-It(tm) note?
You can tell the propaganda is taking hold when someone who is presumably technology friendly (Ryan Singe, author of TFA) has fallen into the current popular media bias.
Can you imagine the liability issues?
Never EVER try to do a good deed in America. You will be sued into oblivion.
I do wish though that there was an electronic version of a good samaratin law.
Surprised that no one has tried to make a connection between this discovery (of the botnets) and the (US Government's) request that Twitter remain online during the recent election protests in Iran.
If we apply the same logic used by the gun control lobbies...
Twitter is evil! It needs to be stopped! Will someone please think of the children!!! Call your local mobst...erm politician and ask them to ban twitter.
Oh and by the way, lets file suite against twitter for any damages that may be caused by the bot nets it (because of course twitter is really an evil AI) controls.
Oh, and one more thing... WILL SOMEBODY PLEASE THINK OF THE CHILDREN?
In Soviet Russia the botnets control Twitter. ...ok, its out of my system now
Posting AC since 4 digit UIDs... too lazy to register.