A forum for reverse engineering, OS internals and malware analysis 

All off-topic discussion goes here.
 #18333  by MajorFunction
 Mon Feb 25, 2013 6:55 pm
Twitter has an API (see here) that lets you search for messages over HTTP. Apparently you can't actually send a tweet using this API though (did I miss something?).

Each day the "clients" generate a unique garbage looking string seeded by the current date and search twitter for command messages with this secret prefix.

If you want to instruct the clients to carry out a specific function, you simply tweet your command with the magic date driven string as a prefix. In the twitter message feed you might see this:
Code: Select all
8Hfio-negt3-8tnjf9k-idnfg8fwn-8uf3 get_update_package hxxp://someurl/new_binary.exe
Is authentication on Twitter required to use the search API too? Also, it doesn't look like automated twitter signup would be doable because it's not documented and they could break your DOM parsing at any time. But it would be good to have the "clients" tweet back, possibly in some encrypted form, heartbeat or status updates .etc

What does it think :?:
 #18336  by reverser
 Tue Feb 26, 2013 2:02 am
Twitter was actually used in Flashback OS X malware, although only to disseminate peers/c&c server updates. See page 6 here.

I'm guessing it will be reasonably easy for Twitter to detect and block such searches.
 #18344  by MajorFunction
 Tue Feb 26, 2013 8:05 pm
Thanks for the link to the paper!

I'm not sure you are right though. I don't think there is much to distinguish a C&C update message some idiots daily microblog.