Attackers Moving to Social Networks For Command and Control

win32sux · 07-20-2010, 12:14 AM

Quote:

Bot herders and the crimeware gangs behind banker Trojans have had a lot of success in the last few years with using bulletproof hosting providers as their main base of operations. But more and more, they're finding that social networks such as Twitter and Facebook are offering even more fertile and convenient grounds for controlling their malicious creations.

New research from RSA shows that the gangs behind some of the targeted banker Trojans that are such a huge problem in some countries, especially Brazil and other South American nations, are moving quietly and quickly to using social networks as the command-and-control mechanisms for their malware. The company's anti-fraud researchers recently stumbled upon one such attack in progress and watched as it unfolded.

Complete Article

Thanks to Slashdot for covering this.

sag47 · 07-20-2010, 12:29 AM

Thanks for posting. An interesting read

Hangdog42 · 07-20-2010, 07:05 AM

Wow. You gotta give the bad guys just a little credit, they are a creative bunch.

unixfool · 07-20-2010, 07:23 AM

Good read!

win32sux · 07-21-2010, 12:57 AM

What do you guys think the next step would be for the bad guys? I agree with this post, in that a move to steganography seems natural to me (or at least, quite probable). Beyond that, though, I haven't a clue. I'd love to hear some of your thoughts on this.

Hangdog42 · 07-21-2010, 07:04 AM

Actually, I think the move to steganography seems a natural one. My one thought on the example in TFA was that it would be horribly vulnerable to discovery. At least in the bioinformatics world there are tons of algorithms for pattern searching in text data. If you move the code out of text and into something more difficult to discover (like a picture), you've probably got the perfect command and control setup.

unixfool · 07-21-2010, 09:22 AM

What Hangdog42 says makes sense. Let's hope it doesn't come to that, though.

What's scary (to me, at least) is the fact that the social network entities appear to either not care or are totally aloof as to how to prevent such account abuse.

sag47 · 07-21-2010, 10:27 AM

There was a prevention for that before... only allowing college kids into the network (Facebook specifically) which is what it was originally intended. They've had this problem since they opened up the gates for anyone to register.

Here's some steganography for ya... Embed a zip file into an image (works best with PNG and JPG).

On Windows:

Code:

copy /b MyImage.png + MyZipFile.zip output.png

On Linux/Mac:

Code:

cat MyImage.png MyZipFile.zip > output.png

unixfool · 07-21-2010, 10:56 AM

Quote:

Originally Posted by sag47

There was a prevention for that before... only allowing college kids into the network (Facebook specifically) which is what it was originally intended. They've had this problem since they opened up the gates for anyone to register.

Even if it were only allowed for college kids, it would probably still be ripe for exploitation. Are you suggesting that this was a non-www thing (ie, on college networks only)? That's not a good safeguard, IMO and leans more toward the 'security by obscurity' method, but it would mean that such placement would hinder malware distribution and exploitation.

And to say that all social networks are/were college-oriented is a bit crazy, IMO. What about LinkedIn (that site was designed for professionals, which normally means non-collegiate)? Almost every site nowadays has some type of social focus, so this issue is probably going to affect more than socially focused sites.

sag47 · 07-21-2010, 11:33 AM

I was speaking of Facebook in particular in this case. Facebook used to only be open to people who had a college domain email address (x@x.edu). Because one of the attacks specifically affected facebook. Please don't apply my single minded statements to a whole genre.

As for how to safeguard from this from all networks I wouldn't know. It's difficult to detect something like this. One possibility is to use heuristics to detect large equal length strings of chars (or similar length from a percentage) and exclude break spaces. But that's a database scan and would tax the system resources away from the users.