Comments on: Twitter API Still Attracts Hackers

By: Denis

Denis — Wed, 02 Jun 2010 21:48:05 +0000

I don’t follow this attack now.

It worked for a few months. If I come across a new working algorithm, I’ll publish the update.

By: cyb3rd0lph1n

cyb3rd0lph1n — Tue, 01 Jun 2010 10:06:02 +0000

Domain generation algorithm seems to have changed at the beginning of May 2010. Any news/info on this ?

By: Denis

Denis — Thu, 10 Dec 2009 21:12:35 +0000

I doubt that the malware itself works with twitter.

By: J.R. Murray

J.R. Murray — Thu, 10 Dec 2009 19:15:06 +0000

Sorry, I was referring to Torpig malware itself. I have searched and not been able to determine this. Thanks again.

By: Denis

Denis — Thu, 10 Dec 2009 18:27:05 +0000

The script works in a browser. So it uses the browser’s settings.

By: J.R. Murray

J.R. Murray — Thu, 10 Dec 2009 15:14:12 +0000

Denis,

Thanks for the great work.

Do you know if any of this malware is proxy-aware? For example, will it use a proxy server if one is configured on the host with Internet Explorer to access search.twitter.com?

By: Thomas J. Raef

Thomas J. Raef — Thu, 10 Dec 2009 01:32:53 +0000

Denis,

I’ve some other code that uses this type of strategy, however it starts with:

$a=”Z6fpZ3dZ22Z2524aZ253dZ2522dw…”

Slightly different but it is still using the Twitter API. I have decoded this part:

Let me know if you’d like the file, although you probably already have it. :)

Nice job on the write-up.

By: Tweets that mention Twitter API Still Attracts Hackers | Unmask Parasites. Blog. -- Topsy.com

Wed, 09 Dec 2009 18:24:49 +0000

[...] This post was mentioned on Twitter by Denis, ak1010 and Malware Domain List, Old Mac Donald. Old Mac Donald said: Twitter API Still Attracts Hackers | Unmask Parasites. Blog.: As of December 2009, hackers more intensively use Twitter http://url4.eu/u6XF [...]