Twitter used as botnet command-and-control hub

After Twitter was itself recently crippled by a cyberattack, new evidence indicates the microblogging site has been used as the key part of an information-stealing botnet operation, said Jose Nazario, manager of security research at Arbor Networks.

Nazario last week discovered a Twitter account that was being used as a command-and-control hub to issue instructions to infected computers that are part of a botnet. Tweets coming from the malicious account, called “upd4t3,” were encoded and looked like a random combination of letters and numbers. But the tweets were actually being used to issue new instructions to bots.

The account since has been suspended.

“These were existing infected PCs and the master piece of malware was listening to the status updates on the Twitter command to update the malware on the machine,” Nazario told SCMagazineUS.com.

The malware on the zombie machines was being updated via Twitter every few hours to avoid anti-virus detection, Nazario said. The majority of the infected computers are located in Brazil, and the purpose of the criminal operation appears to be stealing login credentials for Brazilian banks.

Twitter quickly took down the account after Nazario notified them about it, he said. The bot herder, however, is likely using other Twitter accounts for the same purpose, and other criminals may be using this method too.

“It's not the only botnet using Twitter, and now we begin the process of finding more,” Nazario said.

He added that Twitter likely was used as the control center because, with millions of members, it makes for an easy place to hide.

See original article on scmagazineus.com