Twitter Used As Botnet Command Center

Twitter has been spammed, DDoS'ed, and knocked offline, and now it has been used as the command center for a botnet.

A researcher yesterday looking for clues about the massive distributed denial-of-service (DDoS) attack on Twitter found a Twitter profile that was being used to send updates and malware to bots in an unrelated case of abuse of the site. "This is the first time I've seen in the wild botnet commands being pushed on Twitter -- it won't be the last," says Jose Nazario, manager of security research for Arbor, who first spotted the botnet's tweets. Nazario says there are probably other bot herders doing the same on Twitter.

"It looks like this guy is updating existing bots. I've seen and blogged malicious Twitter accounts in the past that spam links, using lures like 'follow this band!' that link to malcode," he says. But this is the first time Twitter has been used to send commands to bots, he says.

Nazario says Twitter has since disabled the profile, but he says the same user, "upda4t3," also has an account on Google's Jaiku, the search engine giant's microblogging service akin to Twitter. Joe Stewart, director of malware research for SecureWorks, in his Twitter update today said he had found "a newer version of the Twitter Bancos botnet -- this one uses another microblogging service as a backup C&C [command and control]."

Botnet operators are always looking for ways to more stealthily communicate and update their victimized machines -- some use peer-to-peer communications and HTTP to cover their tracks. Twitter is an ideal venue for them because it's flexible, noisy with all of its communiques, and doesn't have the anti-spam controls of other sites, Nazario says. And the anonymity of the URL shorteners also helps them send malicious links under cover, he says.

"They continue to innovate, and Twitter is likely to be yet another new channel to get updates out," he says.

So far, the botnet seems to be all about stealing online banking information from bank customers in Brazil: Nazario found a couple hundred bots based in Brazil, but he says it's difficult to get a real count. "To get that estimate, I went by who checked the update links on bit.ly [that] the bot was pushing via the Twitter updates," Nazario says. "The malware came from somewhere else -- we don't know yet where. The Twitter status updates contain links to new downloads, more malware, and stuff to update and evade AV detection."

Symantec researchers, meanwhile, are also dissecting the malware associated with the Twitter botnet. The Twitter status posts on the upda4t3 account were sending out new download links to malware that Symantec calls Downloader.Sninfs.

The downloader reads a specific Twitter RSS feed once, according to Symantec. "The RSS feed is simply a text file similar to other RSS feeds found on other Internet sites. The RSS text file contains information as to where Downloader.Sninfs can find additional threats to download onto the compromised system. In this way the RSS file acts like a config file for the malware," Symantec researcher Peter Coogan blogged.

The malware downloaded by the Trojan is an existing Bancos password-stealing Trojan, according to Symantec, that poses as the interface at some Brazilian banks in order to steal passwords and other data off the victim's computer.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.