Endpoint
8/14/2009
03:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Twitter Used As Botnet Command Center

Researcher discovers first bot-herder using Twitter as its command-and-control hub, as well as Google's Jaiku microblogging service

Twitter has been spammed, DDoS'ed, and knocked offline, and now it has been used as the command center for a botnet.

A researcher yesterday looking for clues about the massive distributed denial-of-service (DDoS) attack on Twitter found a Twitter profile that was being used to send updates and malware to bots in an unrelated case of abuse of the site. "This is the first time I've seen in the wild botnet commands being pushed on Twitter -- it won't be the last," says Jose Nazario, manager of security research for Arbor, who first spotted the botnet's tweets. Nazario says there are probably other bot herders doing the same on Twitter.

"It looks like this guy is updating existing bots. I've seen and blogged malicious Twitter accounts in the past that spam links, using lures like 'follow this band!' that link to malcode," he says. But this is the first time Twitter has been used to send commands to bots, he says.

Nazario says Twitter has since disabled the profile, but he says the same user, "upda4t3," also has an account on Google's Jaiku, the search engine giant's microblogging service akin to Twitter. Joe Stewart, director of malware research for SecureWorks, in his Twitter update today said he had found "a newer version of the Twitter Bancos botnet -- this one uses another microblogging service as a backup C&C [command and control]."

Botnet operators are always looking for ways to more stealthily communicate and update their victimized machines -- some use peer-to-peer communications and HTTP to cover their tracks. Twitter is an ideal venue for them because it's flexible, noisy with all of its communiques, and doesn't have the anti-spam controls of other sites, Nazario says. And the anonymity of the URL shorteners also helps them send malicious links under cover, he says.

"They continue to innovate, and Twitter is likely to be yet another new channel to get updates out," he says.

So far, the botnet seems to be all about stealing online banking information from bank customers in Brazil: Nazario found a couple hundred bots based in Brazil, but he says it's difficult to get a real count. "To get that estimate, I went by who checked the update links on bit.ly [that] the bot was pushing via the Twitter updates," Nazario says. "The malware came from somewhere else -- we don't know yet where. The Twitter status updates contain links to new downloads, more malware, and stuff to update and evade AV detection."

Symantec researchers, meanwhile, are also dissecting the malware associated with the Twitter botnet. The Twitter status posts on the upda4t3 account were sending out new download links to malware that Symantec calls Downloader.Sninfs.

The downloader reads a specific Twitter RSS feed once, according to Symantec. "The RSS feed is simply a text file similar to other RSS feeds found on other Internet sites. The RSS text file contains information as to where Downloader.Sninfs can find additional threats to download onto the compromised system. In this way the RSS file acts like a config file for the malware," Symantec researcher Peter Coogan blogged.

The malware downloaded by the Trojan is an existing Bancos password-stealing Trojan, according to Symantec, that poses as the interface at some Brazilian banks in order to steal passwords and other data off the victim's computer.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.