For a long time I've been recommending companies to use Intrusion Detection Systems to detect infected/malicious machines on their own networks – instead of detecting inbound attacks (which will definitely happen, and the number of alerts will be in hundreds, if not thousands) they should detect outbound attacks. This way they can early detect potentially compromised internal machines when they phone home or download second stage binaries. Matt Jonkman from Emerging Threats (http://www.emergingthreats.net) has been publishing Snort rules that detect non-standard User-Agent headers for a long time (if you're not using the ET rules set you're missing a lot!). While this still catches a lot of malware, recently I saw more samples pretending to be Microsoft's BITS (Background Intelligent Transfer Service) – the service that's downloading all those updates Microsoft publishes every month. As Microsoft made the BITS API available to anyone, malware authors can use that easily to download their own binaries, instead of Windows patches. Here's an example of a malware using BITS to download second stage binary – notice the target Host: header. If you have other ideas about how to improve User-Agent monitoring let us know. -- |
Bojan 402 Posts ISC Handler Sep 18th 2008 |
Thread locked Subscribe |
Sep 18th 2008 1 decade ago |
Isn't the obvious workaround for malware authors (the ones not using BITS) simply use a UA that is indistinguishable from a normal web browser?
|
Anonymous |
Quote |
Sep 19th 2008 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!