90K Twitter Botnet busted, and what you can learn from it

[RightFootFanatic]

Might be interesting to some of you. A botnet consisting of around 90k Twitter accounts has been busted.

Brian Krebs and ZeroFox published their research, it's worth the read to get some twists and maybe what to avoid.

https://www.zerofox.com/blog/inside-massive-siren-social-network-spam-botnet/

https://krebsonsecurity.com/2017/07/porn-spam-botnet-has-evil-twitter-twin/

 

[MisterF]

I'll read these later over a coffee, thanks.

 

[HoNeYBiRD]

They made a mistake leaving those footprints. The usernames were built around the same pattern, they used similar kind of profile pics and the tweets weren't random enough. Honestly this doesn't require a security firm to notice. Anyone who comes in contact with just two of these profiles, he/she can recognize the pattern. If the SIREN pays more attention to those things, there's a good chance that they wouldn't have been caught. They went to great length to cloak the urls, but they weren't able to write a properly spun message, which would result in millions of unique tweets?

The cloaking part is five out of five stars, the rest (usernames, profile pics, tweets) looks like amateur hour to me.

Free advertisement for DatingGold btw.

 

[Lukmat]

I am always crazy when I see these "security" companies naming patterns. "Siren", "WannaCry"...and other funny names.
For me it's just farm of 90k fake twitter accounts. "Botnet"? lol

 

[Elin Dotsya]

How about: Don't bot. This is Black Hat World, not Hack Forums.

 

[kickthat]

How about: Don't bot. This is Black Hat World, not Hack Forums.

Botting != hacking.
There is nothing wrong with using software to automate tasks. It's particularly common to use software to gain follows/likes/follower etc from social media or to use it to automate posts.

I fail to see your issue.

 

[RightFootFanatic]

How about: Don't bot. This is Black Hat World, not Hack Forums.

Maybe you're on the wrong forum then, https://www.blackhatworld.com/search/7949610/?q=bot&o=date&c[title_only]=1

 

[Elin Dotsya]

Maybe you're on the wrong forum then, https://www.blackhatworld.com/search/7949610/?q=bot&o=date&c[title_only]=1

Guess I'll fly elsewhere then.

 

[itz_styx]

krebs is such a media slut. typical for the security industry, make everything look more evil than it is, hype it and tell the users "but we are the good guys, we protect you, as long as you buy security products from us".
80k twitter accounts used to spam arent a botnet. this is so stupid, whats next "gmail botnet, spammers create millions of accounts" ?

 

[davids355]

Interesting story but zerofox reporting that network to twitter, that is not so cool.

I bet the owners of that botnet are going to be pissed!

And at 30m clicks, how much rev were they generating, even at $0.05 cpc that would be worth $1.5million.

 

[HoNeYBiRD]

And at 30m clicks, how much rev were they generating, even at $0.05 cpc that would be worth $1.5million.

Hard to tell, but $1.5M is a bit too optimistic i think.

They were using DatingGold, i'm not a pub there, but if i were to send 30M targeted hits from Twitter to Chaturbate PPL (they were promoting dating and cams too), that would mean around 300k free registrations, around half of that would be tier 1 and because tier 2, tier 3 pays peanuts, the earnings would be around $150k. Revshare could be better with time, but it's hard to estimate.

Everything depends on how well they were able to target tier 1 countries, which might not be that easy on Twitter, especially when you wrote your tweets with broken English. lol

 

[davids355]

Hard to tell, but $1.5M is a bit too optimistic i think.

They were using DatingGold, i'm not a pub there, but if i were to send 30M targeted hits from Twitter to Chaturbate PPL (they were promoting dating and cams too), that would mean around 300k free registrations, around half of that would be tier 1 and because tier 2, tier 3 pays peanuts, the earnings would be around $150k. Revshare could be better with time, but it's hard to estimate.

Everything depends on how well they were able to target tier 1 countries, which might not be that easy on Twitter, especially when you wrote your tweets with broken English. lol

Good explanation thanks. I just googled "average cpc adult niche"

Oh well $150k or $1.5m if someone I didnt even know deliberately got all my accounts banned and I lost that income I would be pretty pissed off!! But I guess its their fault for having such a big footprint. Next network they build will be a lot less obvious hopefully.

 

[laur.laurix]

white knights fags.....mind ur god damn business and let twitter trim the spam in their yard....btw the network was put down with the help of an inside tip.

 

[HoNeYBiRD]

Good explanation thanks. I just googled "average cpc adult niche"

Oh well $150k or $1.5m if someone I didnt even know deliberately got all my accounts banned and I lost that income I would be pretty pissed off!! But I guess its their fault for having such a big footprint. Next network they build will be a lot less obvious hopefully.

Well, the good thing if you do revshare, that you don't lose the old registrations, so it will still generate a nice sum per month, unless someone pursues your network to close your account. It's just that you don't increase your earnings, if there are no new registrations, the earnings becomes somewhat steady at least for a good while.

 

[davids355]

Well, the good thing if you do revshare, that you don't lose the old registrations, so it will still generate a nice sum per month, unless someone pursues your network to close your account. It's just that you don't increase your earnings, if there are no new registrations, the earnings becomes somewhat steady at least for a good while.

Ah right ok. So that $150k is actually worth quite a bit more than if its a continuous income.

 

[RightFootFanatic]

Ah right ok. So that $150k is actually worth quite a bit more than if its a continuous income.

Even if it were a one time payment it's still a lot of bucks, you could do something great with

 

[aidenhera]

thats not a botnet. botnet is when you have illegall access to many computers through internet.


ohh btw that 90k twitter botnet would be sick for indexing things

 

[Mileslong198]

Brian Krebs help ruin the dump game ...I hate him!

 

[Amoxicillin]

90K is a lot of accounts? Shit, these guys must have been in diapers during the heyday of Myspace spam...

 

[MonzterSlayer]

I’m so confused by the thread title using the word “Busted.”

I’m no security genius like the author of the first article made it seem, but I’ve come in contact with bots like this on Twitter, Facebook, Snapchat, and most likely any other form of social media I’ve had in the past.

What makes this actually matter? They put the pattern together that I feel most knew was a bot originally and with enough of the same messages (literally 2-3) could have said the same thing but much simpler.

Couldn’t this just be referenced to as a marketing bot for porn sites rather than being described as “evil?” That is of course if they didn’t do anything malicious which in the first article I believe they stated the links weren’t malicious, but could easily be changed maliciously.