Viruses/Worms News

Botnet controllers using Twitter, pastebins like SaaS

Tuesday, August 18, 2009

Cybercriminals who control networks of compromised PCs, called botnets, have hit upon new ways to update Trojan malware through Twitter and other online services, which act as a kind of software-as-a-service (or SaaS) for cybercrime.

Last week, Jose Nazario of security firm Arbor Networks discovered Twitter accounts that use status messages (tweets) to send out links containing new commands or executables for the botnet to download and run.

Now, researchers at Symantec have discovered that bot herders are also using pastebins to host obfuscated code that contains Trojan malware. Symantec researchers found messages from Twitter containing base-64 code that translates into links to Debian.net and Rifers.org, both legitimate pastebins that give web users the ability to upload text for sharing information.

The pastenbins contain base-64 code that, once translated, is revealed to be a zip archive with malicious executable files - a Trojan called Downloader.Sninfs.

A new variant of the Trojan threat uses Twitter and another social networking and micro-blogging site, Jaiku.com, Symantec said. The Trojan Downloader.Sninfs.B attempts to get URLs from obfuscated Twitter status messages.

If that attempt fails, the Trojan will use the RSS feed from an account registered on Jaiku.com to obtain the location of remote files, Symantec said on its security blog.