4 ms·
I found the user of Twitter and Google as dead drops interesting. They're both easy channels to disrupt to prevent the malware from receiving instructions, thou
by EvanAnderson 14y ago
I found the user of Twitter and Google as dead drops interesting. They're both easy channels to disrupt to prevent the malware from receiving instructions, though.
I used to speculate in conversation that USENET was just about the best dead drop on the net (actually, I think I heard Bruce Schneier make such a reference in a talk on tradecraft he gave at DefCon one year) being so decentralized. With the decline of USENET I've been hard-pressed to think of a decentralized, distributed dead drop mechanism that malware could make use of.
- roc 14y agoThe problem with even decentralized things like USENET is that when so few legitimate users leverage a thing, it stands out in traffic analysis. Google and Twitter are great precisely because so many people use it. And if the authors had the sense to keep the search terms region/topic-specific the traffic would be nearly impossible to notice or filter, without the benefit of hindsight.