So one day, someone stumbles across this while slutting around the backwaters of twitter:



Looks like total gibberish, but its not.

Each one of those entries is a base64 encoded url. And when the bot on a compromised computer views the url, it can download instructions in the form of dll's/exe's there.

So you have an entire fleet of compromised PCs checking this twitter account every 24 hours or whatever, being told where to download new instructions.

Just an example of the type of resourceful improvise-and-conquer type mentality that keeps the crimescape evolving.

I don't have a Twitter, but I'm assuming you do.

Would this only work if you or the computer started following this account?

Or can one randomly view someones Twitter without having to follow them first?

I actually dont have twitter, but you can totally view twitter posts via like:


[url=index.php?act=findpost&pid=1177542]http://twitter.com/bryanmicon[/url]

Im not logged in, dont have an account, but I can view Micon's posts.

There are probably "private" accounts too, I dont fuck with it so Im not real sure.

why would upd4t3 being following people?

is this an account owned by twitter or someone else?

is it following people? i think it was just posting malware urls in bot-friendly format, no idea if its still active but id assume twitter disabled it already or not.. a lot of cats doing the malware/botnet thing are shockingly informal about it, which isnt entirely shocking considering how many of them are like, euro-tweens.

It did have a couple followers and was following a couple twitter accounts like E! News and the New York Times. You think these eurotweentards would at least make the account private but I guess they don't really care.

I noticed that all those tweets from that upd4t3 account started with the same 15 or 20 characters.

I bet having a botnet mechanism run on such a public service that would be a huge chance for the law enforcement or it might have been to continuously running once found. like having a wire tap where you can see the IP's of controlling the net and at the same time the IP of comprising the net

well you have to consider; there are thousands and thousands of botnets live right now. some are parts of larger botnets and dont even know it, others are for lease and can be merged with other botnets.

its unlikely this was a particularly important botnet, but it was an inventive one.