News for hackers. Stuff that matters.

A comment on Cybercriminals Use Malicious Memes That Communicate with Malware. Parent comment

Re:Cybercriminals Use Malicious Memes That Communicate with ... by mfoy_ on Tuesday December 18, 2018 @09:42AM (#18706632)
So why would the malware not just check the C&C server for orders? Why hope that your victim checks Twitter and sees your memes? This seems like a really roundabout way of accomplishing something trivial (I mean, trivial as compared to infecting a machine with your malware in the first place...)
[ Parent | on HN ]
Re:Cybercriminals Use Malicious Memes That Communicate with ... by taneliv on Tuesday December 18, 2018 @09:51AM (#18706710)
If your C&C server has been "compromised" or blocked by, say, law enforcement, the tweets could instruct malware to use another?
[ Parent | on HN ]
Re:Cybercriminals Use Malicious Memes That Communicate with ... by saltcured on Tuesday December 18, 2018 @06:11PM (#18711485)
Perhaps the malware will sit idle like a "sleeper" agent until activated, and you want to reduce the chance of preemptive detection.

Having its background polling look like a typical Twitter user agent would help it remain hidden and ensure that its command channel is not blocked. (At least for a large class of victims who do not have severe network restrictions in effect.)

You could also send the destination address via Twitter, so that the malware does not leak information about the controller ahead of its activation or so that the controller can make last minute arrangements of temporary resources...

[ Parent | on HN ]
Re:Cybercriminals Use Malicious Memes That Communicate with ... by dotancohen on Tuesday December 18, 2018 @10:56AM (#18707446)
Because that would reveal the location (IP address) of the C&C server, in addition to making it a point of failure.
[ Parent | on HN ]
Re:Cybercriminals Use Malicious Memes That Communicate with ... by mfoy_ on Tuesday December 18, 2018 @04:33PM (#18710795)
But the output of all the commands still sends to the C&C server, so I don't see how this protects that. Unless, as the other user suggested, the memes could actually also contain the IP to use for the C&C server. So the "order" is akin to "upload username to ###.##.###.#"
[ Parent | on HN ]