Twitter Meme Hack Explained: A new strain of malware has been discovered that takes its instructions from code hidden in memes posted to Twitter and takes screenshots of the infected system, reported researchers at cybersecurity firm Trend Micro. Twitter has disabled the hacker's account on its platform. But it isn't clear still not how the attacker was circulating the malware, a Trojanized .exe file.
How does Meme hack work?
According to reports, the hacker has been using “What if I told you” meme to secretly tell a Windows-based malware when to take screenshots from infected systems. The malware quietly infects a vulnerable computer, takes screenshots and send it back to the malware's command and control server.
What technology hacker used for Meme hack?
According to experts, the hacker has used steganography techniques to hide the command “/print” in the image, which told the malware when to take a screenshot of a system. The malware then obtains the address where its command and control server is located and send the screenshots back to the server.
Other hidden commands the hacker could've sent through the memes include “/clip” to capture clipboard copied content, and “/processors” to retrieve a list of running processes over the PC.
What cybersecurity experts are saying about Meme hack?
Attackers are always trying to find new methods to work around detection systems such as anti-viruses, intrusion detection systems and anomaly detection systems, all of which are trained to detect certain kind of pattern/anomalies suggesting malware activity, according to Ankush Johar, Director at Infosec Ventures.
“As seen in the past, hackers have been using use popular service like Google Drive, Dropbox etc to hide malware snippets and commands as these are websites that are generally not considered suspicious and that's the same reason why hacker has chosen Twitter in this case,” said Johar.
“This goes on to show that even having the best detection and prevention system is not enough. Protecting from an infection in the first place is what is most important. Such malware mostly spread via pirated websites and phishing attacks. Humans are the weakest link in cybersecurity and hence that's the easiest link for hackers to exploit. The security of users lies in their own hands and the only way to be secure is to be vigilant and suspicious by nature,” added Johar.
Agreeing with the view of Johar, Farrhad Acidwalla, founder of CYBERNETIV DIGITA said that 2019 is here, and the quantum of global hacks has Internet consumers unquestionably more cognizant of security and privacy issues than they were a year or two ago. Twitter knows user trust is critical and notified users as a measure of transparency.
“While this took a hit on their stock price, consumers need platforms to be on top of incidents where global attacks could be distributed through them. While core Twitter was not hacked, the malicious attackers used it as a distribution platform to send commands to their malware on infected devices,” said Acidwalla.
“Twitter did not rule out the possibility of a state-sponsored background to this suspicious activity. The security community knows it has to stay ahead of the curve with the growing sophistication of attacks world over. The bright side here is that this has come to light before reaching any known mass exploitation,” said Acidwalla.
How to avoid cyberattack like Meme hack?
Johar said that user should completely avoid pirated content based websites and stay extremely cautious with emails with attachments, links or asking to download a file. He suggests that having a good antivirus always helps but not more than having an eye for detecting phishing attacks.
