3 ms·

TLDR: malware uses meme images containing hidden instructions posted on Twitter as a way to receive commands. It's one-way communication though - the result of

TLDR: malware uses meme images containing hidden instructions posted on Twitter as a way to receive commands. It's one-way communication though - the result of the operation is still uploaded to a C&C server.

qaq 8y ago
you could ex-filtrate data by the same mechanism though (e.g posting images to twitter)
- pilsetnieks 8y ago
  That might attract some attention, for example, in a corporate environment where everything is locked down.
  - starbeast 8y ago
    Some things will seem very innocent though. Having a video call with a family member while sending out data under the noise floor.
  - qaq 8y ago
    In reality the amount of alerts a SOC has to triage is so big on avg I doubt they would really be looking into someone accessing twitter.
mfoy_ 8y ago
So why would the malware not just check the C&C server for orders? Why hope that your victim checks Twitter and sees your memes? This seems like a really roundabout way of accomplishing something trivial (I mean, trivial as compared to infecting a machine with your malware in the first place...)
- taneliv 8y ago
  If your C&C server has been "compromised" or blocked by, say, law enforcement, the tweets could instruct malware to use another?
- dotancohen 8y ago
  Because that would reveal the location (IP address) of the C&C server, in addition to making it a point of failure.
  - mfoy_ 8y ago
    But the output of all the commands still sends to the C&C server, so I don't see how this protects that. Unless, as the other user suggested, the memes could actually also contain the IP to use for the C&C server. So the "order" is akin to "upload username to ###.##.###.#"
- saltcured 8y ago
  Perhaps the malware will sit idle like a "sleeper" agent until activated, and you want to reduce the chance of preemptive detection. Having its background polling look like a typical Twitter user agent would help it remain hidden and ensure that its command channel is not blocked. (At least for a large class of victims who do not have severe network restrictions in effect.) You could also send the destination address via Twitter, so that the malware does not leak information about the controller ahead of its activation or so that the controller can make last minute arrangements of temporary resources...

qaq 8y ago

you could ex-filtrate data by the same mechanism though (e.g posting images to twitter)

pilsetnieks 8y ago
That might attract some attention, for example, in a corporate environment where everything is locked down.
- starbeast 8y ago
  Some things will seem very innocent though. Having a video call with a family member while sending out data under the noise floor.
- qaq 8y ago
  In reality the amount of alerts a SOC has to triage is so big on avg I doubt they would really be looking into someone accessing twitter.

mfoy_ 8y ago

So why would the malware not just check the C&C server for orders? Why hope that your victim checks Twitter and sees your memes? This seems like a really roundabout way of accomplishing something trivial (I mean, trivial as compared to infecting a machine with your malware in the first place...)

taneliv 8y ago
If your C&C server has been "compromised" or blocked by, say, law enforcement, the tweets could instruct malware to use another?
dotancohen 8y ago
Because that would reveal the location (IP address) of the C&C server, in addition to making it a point of failure.
- mfoy_ 8y ago
  But the output of all the commands still sends to the C&C server, so I don't see how this protects that. Unless, as the other user suggested, the memes could actually also contain the IP to use for the C&C server. So the "order" is akin to "upload username to ###.##.###.#"
saltcured 8y ago
Perhaps the malware will sit idle like a "sleeper" agent until activated, and you want to reduce the chance of preemptive detection. Having its background polling look like a typical Twitter user agent would help it remain hidden and ensure that its command channel is not blocked. (At least for a large class of victims who do not have severe network restrictions in effect.) You could also send the destination address via Twitter, so that the malware does not leak information about the controller ahead of its activation or so that the controller can make last minute arrangements of temporary resources...