Twitter-based Botnet Command Channel

Using Twitter (or some other public messaging bus) allows the bots to connect to a control channel that is already highly available and accessible (heh, Twitter... yeah, I see the irony). This should make it somewhat easier to hide the bots behind a couple of proxies (if you want to mask your identities).

The IP(s) of Twitter are also less likely to be blocked, and the protocol itself (HTTP) is probably less restricted than IRC on sketchy networks, and also less likely to be blocked by firewalls and/or routers around infected PC's.

It seems like it is partially a "because I can" experiment, and partially an attempt to adapt and change the way botnets operate (and are thus detected).

The thing, to me at least, is that this seemed to obvious. With all the noise on twitter and spam and marketeers, it would have seemed easier to setup a bot-based Twitter account with a glossy marketeer profile that basically just RT'd other garbage SEO/marketing spam junk. Then, randomly slip in these encrypted commands. Maybe even break the command over a couple of tweets/RTs to make it less obvious. You would have a sort of steganography kind of encryption, with the data hidden in plain sight.

Malware just need a C2 for a day or two and then they mve along to another. The days of clinging on to one source are long gone. Please see http://www.pandasecurity.com/usa/homeusers/media/press-relea...