Attackers Using Social Networks For Botnet Control 40
Trailrunner7 writes "Bot herders and the crimeware gangs behind banker Trojans have had a lot of success in the last few years with using bulletproof hosting providers as their main base of operations. But more and more, they're finding that social networks such as Twitter and Facebook are offering even more fertile and convenient grounds for controlling their malicious creations. New research from RSA shows that the gangs behind some of the targeted banker Trojans that are such a huge problem in some countries, especially Brazil and other South American nations, are moving quietly and quickly to using social networks as the command-and-control mechanisms for their malware. The company's anti-fraud researchers recently stumbled upon one such attack in progress and watched as it unfolded."
Obvious next step (Score:5, Insightful)
Steganography [wikipedia.org]. Of course it alone won't keep a good virus researcher from figuring out what's going on, but Facebook/whoever will just see a legitimate profile (and that may make it that much harder to get it taken down).
Messages posted, postings on others' walls, images posted, even friends made in a particular order could all carry hidden meaning for watching malware.
Re: (Score:2)
Re: (Score:2, Insightful)
The point is still valid regardless of how much you obfuscate the process of searching for commands. Lets say you have a botnet client that scans the images on 10,000 Facebook profiles looking for commands hidden by a steganographic process. A security researcher who has a copy of your botnet client is still able to either disassemble your client or monitor the execution/memory of your client and reverse engineer whatever methods you use to search for commands.
It's similar to the way a piece of software che
Re: (Score:1)
What's good for the goose is good for the gander.
If defenders could figure out the code, well, I believe this vignette from Star Trek: Next Gen will help:
Data: I have access to the Borg collective
Picarborg: Sleep. Sleep, Data.
Dr. Crusher: He must be exhausted.
Data: Most certainly. But I think he may be telling us something.
Re: (Score:2)
You said it yourself, steganography is used when trying to conceal that communication is taking place. Isn't that what botnet operators want?
Assuming that access to Facebook, etc. isn't already blocked, a network admin isn't going to notice image downloads from Facebook as quickly as they would repeated hits to http://botnetsite.ru/ [botnetsite.ru] and there is a lesser chance of the botnet being detected at all.
Re:Obvious next step (Score:4, Interesting)
I would love to mod this "Like", but I fear that will launch an attach from BotVille. Speaking of which, why not just use a malware metaphor, say farming, build up a fake business around that as a "game". Then let thousands of stupid people who like shitty "games" play it to control and command their warez-botz-thingyz? Ooops, too late!
Re: (Score:1)
That seems to be the case when I upload a large photo directly from my camera, and on facebook it has been scaled down.
So I guess it would work as long as the data doesn't get corrupted.
Re: (Score:2)
Re:Obvious next step (Score:4, Funny)
With status messages like:
ProcessingNode192 is bored (has nothing to do)...
StorageServer01 is feeling degraded (on array #2)...
Already possible (Score:2)
OSSEC HIDS supports status updates via twitter, so your IDS control server can gossip and bitch about the ailments of its clients like a senile small-town doctor:
http://www.ossec.net/dcid/?p=168 [ossec.net]
You could also use Twidge [ubuntu.com] and your imagination to come up with some cron jobs that post server status updates.
Re: (Score:2)
Noting that in this case, the malware did not bother hiding the messages, but just posted them as notes instead [rsa.com]
Finally, IRC is safe! (Score:5, Funny)
I was really starting to worry that these Command & Control things that use IRC chatrooms were going to ruin the good reputation that IRC has built up over the years.
Re: (Score:1)
wow you're kind of a douche bag. chill out man
Re: (Score:1)
While it's true that honest, spontaneous spit-takes are rare, they're an exceptional sight to behold -- specifically because you know they're so rare.
Re: (Score:2)
Serials.
Re: (Score:2)
IRC is a pretty primitive chat program, so it will never earn a good reputation. http://www.youtube.com/watch?v=O2rGTXHvPCQ [youtube.com] in case you're bored.
Re: (Score:2)
I was once booted from a #Unix IRC channel for being too smart.
True story.
is this news? (Score:2, Informative)
Re: (Score:2, Informative)
Re: (Score:1)
Yes, Marianne, hackers innnovate. any other news? (Score:2)
Yes, Marianne, hackers innnovate. any other news?
Re: (Score:2)
The new IRC? (Score:2, Insightful)
Meh, IRC has been used for this purpose for a long time. Switching to the centralised Twitter service for increased anonymity is just an evolution, not a revolution.
Re: (Score:2)
Re: (Score:2)
And? (Score:1)
Please stop calling them 'cybercriminals' (Score:1)
It's as if a journalist is trying to make nerdy white-collar crime sound cool.
Stop it journalists! You're making it worse! Ooh, and now they're using crimeware!
this is atleast 10 years old... (Score:1)
So it changes from hotmail to facebook, or aol to twitter, or icq to myspace...it is all the same use a free networking tool to communicate to your botnet commands .....I use /. myself....so much cooler, especially when you get modded down you can implement an auto attack for the person modding you down... ; )