Twitter as Command and Control

It’s been a while since I’ve posted on some actual exploits, and for that I apologize.

There is a particular exploit that came to light a couple of months ago, but that I still find intriguing.  In this case, botnets were using Twitter as a Command and Control center.  The way it worked was the infected machines (bots) knew to look at the tweets on a particular Twitter account.  These tweets held encoded information about where the new command and control center for the botnet was located.

This is an example of business logic abuse – in this case the bot herder used the tweet function to control his bots.  This means he was using Twitter in exactly the way it was intended – to post tweets on his own account – but was doing it to perpetrate malicious activity.

The brilliance of this comes from that fact that command and control centers are the heart of a botnet.  And by having his bots check for updates on Twitter, the bot herder was guaranteeing that the place the bots would check would always be live – who would take down Twitter?  Of course, Twitter disabled his account, so that beats my logic, but, still, this is incredibly devious.

It will be very interesting to see what business logic abuse types stem from this attack!