Slashdot Mirror
Hackers Increasingly Using Twitter For Botnets
Trailrunner7 writes "Spammers aren't the only ones who have figured out that social networks like Twitter and Facebook are good for business. Sophisticated hackers conducting targeted attacks are also using the networks as a tool to manage malware installations on victims' networks.
Mandiant's latest "M-Trends" report, released on Thursday, says that the company has observed an increasing number of so-called "Advanced Persistent Threats" that are hijacking legitimate social networks and Web based services, including Facebook, Google Chat and MSN as command and control networks for malware installations. The revelation is part of a larger trend that saw sophisticated attacks on commercial entities outstrip attacks on the networks of government agencies and defense industry players, Mandiant reported."
I don't understand what the incentive is to stop using IRC for command and control.
Twitter is actually good for something after all
I've never actually been involved in creating, maintaining, or commanding a botnet, but in college I thought this would be an interesting project, so I spent some time thinking about it. One issue involved is: how would peers in a botnet discover each other, when I don't want to run something like a central server?
This was 2005 or so, so twitter didn't exist. My idea to make the bots do targeted vandalism to Wikipedia, in a way that looks benign (like some punk kid) but my clients would crawl the site looking for this coded vandalism, and use that to discover peers.
I never tried this, and I guess for a site like Wikipedia my clients would get banned pretty quickly, and if they ever got large in number the whole thing wouldn't work. I guess they've also added captchas for anonymous users. But twitter seems just right for this purpose: there's already a lot of noise on the site and it's doubtful that anyone is really monitoring what kind of crap people are putting there. And it has a search feature. There are already lots of spambots on there as well.
But then, someone else here suggested, why not just mooch off someone's IRC server? I suppose that would work just as well.
Not surprising. Bots mostly went from IRC-controlled (insecure, inefficient, unreliable, weak) to IRC+SSL-controlled (inefficient, unreliable, weak, massive-computational-cost) to proprietary P2P networks (overwhelming complexity). At the same time there was HTTP (inflexible, weak) and IM*. Bot coders are some of the laziest programmers around... of course they will let someone else solve their biggest issue.
* I never saw IM used in practice, so I don't really know the drawbacks around it. Probably hard to maintain with all the constant protocol changes.
with how Twitter and various other social networks utilize hyperlinks. The problem is that most URLs are shortened in messages, so all person A has to do is tell person B something is going on, and click the link to find out more. Person A clicks link, silent download commences. It's circumstances like these where I wish URL shortening would just fall off the face of the earth. It just has such a high possibility of being exploited and there's no way to see where the shortened URL will go without using some script, it's just not that safe.
Someone found a good use for twitter!
Gee George, deez hackers shore are sophistimacated!
http port is just not as blocked as other ports
So just block Facebook and Twitter at the firewall. Problem solved.
Whee! This security stuff is easy.
But how do you control it with only 140 characters to s
You issue it a base64 encoded URL where to get more instructions. Then the attacker can use any website, google pages, etc to issue the command.
I followed one of them once, they usually added layers of abstraction to make it 'difficult' for a human to follow. Meaning one tweet, lead to another tweet, lead to another tweet, lead to a URL, which had another URL which then contained something like "ping whitehouse.gov"
Google Chat?
Those hackers must be busy....
You issue [a] URL where to get more instructions. Then the attacker can use any website, google pages, etc to issue the command.
Yes you can. And this *isn't* hacking, cracking, or any hot sound-byte word.
If you want news from today, you have to come back tomorrow.
Wouldn't it be cool if some trojan just looked up popular hash tags and used those as some form of command? The People's Botnet, who knows what it'll do.
http://twitter.com/ns111042
If a group of people play online on the same game and interact, then it's teamwork in some form. No matter what term you call it. If they want to take "Gangs" out of online games. Then take multiplayer out completely. As long as two people have the ability to be allies, there is going to be teams, as they put it, gangs.
I posted about this being the case way back (5 years ago?) when people were talking about IRC bots and CCs, but I got to say, it is impressive that now so many years later, people are catching up to this style of thinking, gives me hope for hackers out there..
And leave off the last "s" for savings!
more likely the bot will be able to get a phone home out of a corporate network if it's doing HTTP than IRC. also more likely able to pull an update or read a command.
using a HA web service just seems like a no brainier.
your have a disturbed HA service to run your command and control, you can also have a lot more points to issue commands from.
eliminates a lot of problems so long as you can evade the people trying to remove your compromised accounts on the HA host...