Dormant botnet of 350,000 Twitter accounts unearthed
Cybersecurity researchers at University College London have discovered a Twitter botnet consisting of 350,000 automated accounts. They’ve dubbed the network “the Star Wars network” and believe it has existed undetected since 2013. The longevity of the botnet raises questions over their impact, and the way they are tracked and monitored. The entire botnet, which tweeted quotes from Star Wars books, was created in just a few days in June and July 2013, producing 150,000 new tweets per day. The researchers report they have discovered another botnet with 500,000 bots, which they will discuss soon.
That’s why Twitter has an ongoing program to detect and remove malicious bots. But as soon as a new technique becomes available to identify these accounts, botmasters modify and upgrade their charges to avoid detection.

The truth is that nobody knows how many Twitter bots are out there or how big the botnets have become.

Today that changes thanks to the work of Juan Echeverria and Shi Zhou at University College London. These cybersecurity experts have stumbled across a Twitter botnet consisting of more than 350,000 automated accounts, a network of almost unimaginable proportions, that has existed undetected since 2013. They call this network the “Star Wars botnet” and say that its longevity raises serious questions about the potential impact of botnets and the way they are tracked and monitored.

Echeverria and Zhou discovered this botnet almost by accident. Interested in finding automated accounts, the researchers began by downloading details of six million English-speaking Twitter accounts that they randomly selected. That’s about 1 percent of the total number of Twitter accounts.

Twitter allows the most recent 3,200 tweets to be downloaded along with any geo-tags attached to the tweets. This allowed Echeverria and Zhou to map the locations of all these tweets. That’s when they noticed something strange.

For the most part, the geographical distribution of tweets matches the global population distribution. In other words, tweets are more common in densely populated areas like cities. But the researchers also noticed a significant number of tweets—some 23,000 of them—that were geo-located in uninhabited regions close to Europe and the U.S., such as in deserts and in oceans.

When plotted on a map, these locations were bounded by sharp edges and corners that formed two rectangles, one around the U.S. and the other around Europe. “We conjectured that the [map] shows two overlapping distributions,” say Echeverria and Zhou. They thought that one set of tweets must be from real users and so coincided with the population distribution.

But the other must have been created by Twitter bots randomly choosing locations in the two rectangles. The goal, thought Echeverria and Zhou, was to convince other Twitter users that the tweets were created in the two continents where Twitter is most popular.