Slashdot Mirror
Attackers Using Social Networks For Botnet Control
Trailrunner7 writes "Bot herders and the crimeware gangs behind banker Trojans have had a lot of success in the last few years with using bulletproof hosting providers as their main base of operations. But more and more, they're finding that social networks such as Twitter and Facebook are offering even more fertile and convenient grounds for controlling their malicious creations. New research from RSA shows that the gangs behind some of the targeted banker Trojans that are such a huge problem in some countries, especially Brazil and other South American nations, are moving quietly and quickly to using social networks as the command-and-control mechanisms for their malware. The company's anti-fraud researchers recently stumbled upon one such attack in progress and watched as it unfolded."
Steganography. Of course it alone won't keep a good virus researcher from figuring out what's going on, but Facebook/whoever will just see a legitimate profile (and that may make it that much harder to get it taken down).
Messages posted, postings on others' walls, images posted, even friends made in a particular order could all carry hidden meaning for watching malware.
I was really starting to worry that these Command & Control things that use IRC chatrooms were going to ruin the good reputation that IRC has built up over the years.
I thought they had been doing this for a long time now.
Yes, Marianne, hackers innnovate. any other news?
This is not a signature.
Meh, IRC has been used for this purpose for a long time. Switching to the centralised Twitter service for increased anonymity is just an evolution, not a revolution.
It may not be news in itself that they innovate but where exactly they are moving to now is news. You could just as easily say all of those words have been written before, in the dictionary. It wouldn't mean that it is not newsworthy.
every anarchist is a baffled dictator. Benito_Mussolini
Read that as "Hackers Using Social Networks For birth Control"... and I wondered where the news was....
Must get more sleep...
IRC is a pretty primitive chat program, so it will never earn a good reputation. http://www.youtube.com/watch?v=O2rGTXHvPCQ in case you're bored.
woosh
Yes, use twitter. They have great uptime /s
On the bright side, this could mean less SPAM in our inboxes.
Advertisers have been using all kinds of networks to "control their bots" since the dawn of civilization. Anyway, we each gotta do our bit... good of society, et al.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
I can't log into the face-book, my farm is gonna die! Halp!
It's as if a journalist is trying to make nerdy white-collar crime sound cool.
Stop it journalists! You're making it worse! Ooh, and now they're using crimeware!
So it changes from hotmail to facebook, or aol to twitter, or icq to myspace...it is all the same use a free networking tool to communicate to your botnet commands .....I use /. myself....so much cooler, especially when you get modded down you can implement an auto attack for the person modding you down... ; )
OSSEC HIDS supports status updates via twitter, so your IDS control server can gossip and bitch about the ailments of its clients like a senile small-town doctor:
http://www.ossec.net/dcid/?p=168
You could also use Twidge and your imagination to come up with some cron jobs that post server status updates.
"When information is power, privacy is freedom" - Jah-Wren Ryel