Controlling a botnet with 140 characters or fewer

Jose Nazario, writing on the Arbor Network Security blog �Security to the Core,� has described a botnet that uses Twitter as a command-and-control channel. The bot owner sends update information in a tweet and RSS feeds send it to the botnet.

The tweeted update information is in the form of a shortened URL, which leads to one of several malicious web sites. Before they were taken down, Nazario found that the sites downloaded a packed .exe file that was an information stealer (Buzus) and packed .dll file loaded with URL�s where the .exe could phone home the information.

The mechanism seems to be the work of Brazilian ID thieves, he said.

Blog post here.

Tom Kelchner