Drive-by exploit writers have been spotted using a popular Twitter
command to send web surfers to malicious sites, a technique that helps
conceal the devious deed.
The microblogging site makes application programming interfaces (APIs) such as this one
available so legitimate websites can easily plug into the top topics
being tweeted. As the concerns and opinions of Twitter users change
over time, so too will the so-called top 30 trending topics.
But it turns out that the API for generating the never-ending stream
of keywords is being used by miscreants, too. According to researcher
Denis Sinegubko, it's being added to heavily obfuscated redirection
scripts injected into compromised websites. The scripts, which redirect
victims to drive-by sites that attempt to exploit unpatched
vulnerabilities in programs such as Apple's QuickTime, use the second
letter of a trending topic to arrive at a secret code that's a key
ingredient in determining the contents of the domain.
The top term "Jedward" from a few days ago, for instance, becomes
ghoizwvlev.com. Other domain names generated this month included
abirgqvlev.com, fgxhzgvlev.com and abxhcgvlev.com.
"To make the domain name generation less predictable, they use the
code of the second character in the Twitter search that was the most
popular two days earlier," Sinegubko writes. "This way they have one day to register a new domain name that will be active the next day."
The Twitter API is a useful weapon in the miscreant's arsenal
because it helps prevent malicious scripts from being caught by
scanners searching for malicious domain names in web scripts. Instead
of seeing a URL known to be distributing malware, the scanners see a
widely used API for one of the world's most popular websites.
If the scheme sounds like a lot of work to keep drive-by exploit
sites concealed, you're right. Something seems to have gone wrong, and
of the many generated names Sinegubko checked, only one was registered,
and that one suffered from internal errors.
Still, the technique shows the continuing evolution of attackers
striving to find new ways to cloak drive-by attacks. And based on this analysis
of the Torpig botnet, Sinegubko isn't the only white hat hacker who has stumbled onto it.
"This is probably the most creative malicious script I've seen so
far," Sinegubko writes. "Luckily for us, it was not very well thought
out."
Source: http://www.theregister.co.uk/2009/11/12/attackers_use_twitter_command/