Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Used To Control Botnet Machines

Posted by ScuttleMonkey on from the it's-all-spam-to-me dept.

DikSeaCup writes "Arbor Network's Jose Nazario, an expert on botnets, discovered what looks to be the first reported case of hackers using Twitter to control botnets. 'Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies, to counter efforts to track, disrupt and sometimes decapitate the bots. Perhaps what's surprising then is that it's taken so long for hackers to take Twitter to the dark side.' The next step, of course, is to code the tweets in such a way that they aren't so suspicious."

13 of 127 comments (clear)

  1. Sure, but by operator_error · · Score: 4, Funny

    Sure Twitter is just a large botnet, but is anyone really in control?

  2. Holy shit! by SatanicPuppy · · Score: 5, Funny

    Who knew Twitter had a use?!?!

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    1. Re:Holy shit! by Korin43 · · Score: 4, Insightful

      So basically we need email, but with a 150 character limit?

  3. Reliable by Marillion · · Score: 5, Insightful

    Twitter isn't as reliable as IRC.

    --
    This is a boring sig
  4. Re:Alas, Babylon by clone53421 · · Score: 4, Insightful

    That's actually an interesting thought... it was sending obfuscated URLs to code that the zombie bots would download and execute.

    Wouldn't it make sense, rather than having Twitter simply kill the account, to allow the "good" guys to craft some sort of zombie-self-destruct and tweet its URL over the account? Imagine, all the bots automatically downloading and executing a specially designed tool that removes the malicious trojan...

    --
    Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
  5. I <3 English by sootman · · Score: 4, Funny

    "Twitter Used To Control Botnet Machines"

    It used to, but it doesn't anymore, right?

    --
    Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
  6. You go Jose! by GPLDAN · · Score: 4, Interesting

    Jose and those guys at Arbor are doing really concrete things to curb botnets and malware contagion. They have their gear in a great number of peering points around the world, and are correlating huge amounts of data into discrete patterns. I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.

    1. Re:You go Jose! by 99BottlesOfBeerInMyF · · Score: 4, Interesting

      I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.

      I haven't talked to Jose for a while, but last I heard he and the other guys were doing well finding new types of malware and separating out malicious network traffic that is hard to differentiate from legitimate traffic. That said, they were not really doing things to find the one off attacks perpetrated by people who weren't interested in large scale and automated network attacks. The people I'd call ghosts are the ones who do small scale, specifically targeted attacks to get what they want, then walk away. If you're running a botnet, you aren't being very ghostlike; maybe more vampire like :)

  7. It's easy to do. by lymond01 · · Score: 5, Funny

    No onE would Think of uSing slashdoT As we aRen'T nearly as oBviOus as someThiNg likE Twitter. // Especially with all our talk about supporting Linux and such.

    1. Re:It's easy to do. by Pulse_Instance · · Score: 5, Funny

      We use linux to read slashdot so your net start does nothing to us.

  8. tried it, but... by wibald · · Score: 4, Funny

    Sure they tried using Twitter to control their botnet but after sending out one set of instructions they got bored and went back to playing MafiaWars on Facebook.

  9. Perl by BJ_Covert_Action · · Score: 4, Funny

    The next step, of course, is to code the tweets in such a way that they aren't so suspicious

    And people said that perl obfuscation, poetry, and golf tournaments didn't have any practical application. Ha!

    --
    Motorcycles, Robots, Space Gossip and More!
  10. Interesting code actually... by 0100010001010011 · · Score: 4, Informative

    From the looks of it it's all base64 encoded shortened URLs.

    aHR0cDovL2 is http:///
    aHR0cDovL2JpdC5seS is http://bit.ly/

    The first one is clipped.
    The rest go to a pastebinish sites which have gbpm.exe encoded as Base64. It also appears the base64 is different but the exe has the same name (I'm guessing it's changed 'output'?)

    http://rifers.org/paste/content/paste/9507/body?key=upd4t3
    http://rifers.org/paste/content/paste/9508/body?key=upd4t3
    http://rifers.org/paste/content/paste/9509/body?key=upd4t3

    They also use Pastebin (http://pastebin.com/pastebin.php?dl=m49f3b4c2) and Debian.net (http://paste.debian.net/44059/download/44059) but both of those file have been deleted.