Posted by: Ken Harthun
Botnet, Exploits, Security, Twitter
A botnet that uses Twitter for command and control? You bet. Jose Nazario over at Arbor Networks apparently found one: “Basically what it does is use the status messages to send out new links to contact, then these contain new commands or executables to download and run.” The bots connect to the Twitter account using an RSS feed, allowing them to receive the tweets in real time without having their own accounts on Twitter. Pretty slick.
The tweets themselves are base64 encoded and when Nazario translated one of them, it was clear the encoded tweet was sending links to the bot.
Oddly enough, there’s no mention of this at http://status.twitter.com, but the account in question (well, one of them, at least—there are probably more), https://twitter.com/upd4t3, has been suspended, so it appears that Twitter security folks are on the ball.