Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My computer does a lot of queries to strange domains such as:

56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com

The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of the string "Ebay.com"

Is it a malware? It seems to build hidden queries to well known web site.

---- EDIT ----

This is not the only SHA1 domain prefix that I found, another one exist for "Twitter.com".

Another factor I have to add to the discussion is that when you find an HEX string of length of 16, or 20 is very likely it is an hash. The first thing you can do is a search on Google. There are many web sites that collect hashes (MD5 or SHA1) strings. Try to put the HEX string in google and see :)

share|improve this question
    
Okay, exactly how did you figure this one out? –  Iszi Feb 15 '12 at 22:23
    
How did you know this was the SHA1 of the domain name? –  makerofthings7 Feb 15 '12 at 22:48
    
What application is the request coming from? –  SteveS Feb 15 '12 at 22:54
1  
@TLDR I can't speak for robob, but I do use Google whenever I investigate something that involves a mysterious 32-digit or 40-digit or 64-digit hex string. –  Gilles Feb 16 '12 at 0:48
2  
@robob - if you want some more serious answers, I think you should try to provide more details, test a few things etc. Less abstractions, more concrete info. –  Yoav Aner Feb 18 '12 at 9:23
show 13 more comments

3 Answers

Is this a web browser?

Some browsers limit concurrent connections to 2 when accessing a domain name. A performance hack is to create a wildcard DNS name that resolves to the www site.

The when javascript, or a server side app generates URLs to the server, then more concurrent downloads are permitted.

Is it an app?

In addition, the .NET framework limits outbound connections as well. The developer may not know about system.net.servicepointmanager.defaultconnectionlimit, or how to override this on a per-host or per-appdomain. They may be using a similar hack even though it's not needed.

My guess is that something similar applies to Java, etc...

Lastly, it could be something malicious. It depends...

share|improve this answer
    
I don't understand how this relates to the question, this may be due to my ignorance about web development. Why would an application make DNS requests to hash(domain_name).domain.com rather than the domain name itself? –  Gilles Feb 15 '12 at 22:45
    
@Gilles - Performance... then again the value is typically random, not the SHA1 string. –  makerofthings7 Feb 15 '12 at 22:48
    
Sorry @make... but you have to instruct the DNS to resolve these kind of (random or SHA1) DNS names. How is the DNS instructed to understand this? Can you link some references? –  robob Feb 16 '12 at 6:27
    
@robob: you just set up a bunch of random-hash subdomains, have them all resolve to the same application on the server: voila, you now have several aliases for your application, allowing you to bypass the per-domain connection limit (you can now make 10 concurrent requests to your server by using 10 different subdomains). –  tdammers Feb 16 '12 at 6:54
    
mhh, ok so it could be normal to see these log entry with Ebay.com SHA1ed...It's browser capability to overcome the limits...If I have understood you :) –  robob Feb 16 '12 at 7:33
show 1 more comment

Pure speculation, but I had to give it a try (always fun playing Sherlock Holmes every once in a while - the pre-Hollywood version obviously).

First of all, it's possible, or even likely that .domainname.com is being automatically added by your Operating System. It's quite common to append a domain suffix for DNS queries for a hostname without extesion. My hypothesis is therefore based on the fact that some program simply tried to resolve 56cea5c2b408989ab067adcb787d0f99209bbe07 without any extension. This part of the theory is easy to check on your computer though.

Why would a program try to resolve {something_random} or {hash_of_something}? I am guessing just to test whether name resolution works, and also trying to avoid caching or static /etc/hosts records.

Why hash('ebay.com')? That's the strangest part, but perhaps the developer couldn't figure out a better way to generate a random-like value? so they were just feeding some strings into the hash function? This is the odd part for sure, but there could be a simple explanation (i.e. developer just being stupid/silly/quirky).

share|improve this answer
1  
I have a hard time imagining doing the request on hash(site) for any reason other than hiding the site name to a casual filter or log reader. (For better stealth, this app should use a salt, if perhaps not PKBDF2 for server-side performance reasons :-) And I have a hard time imagining doing this for a purpose that is neither nefarious nor working around a stupid firewall, and the latter doesn't seem applicable here. –  Gilles Feb 16 '12 at 0:03
    
hiding the site name however does nothing. Can you resolve a hash(ebay.com) and get a response from the dns server? I don't think so. I tend to think there are far more stupid/naive people doing silly or trying-to-be-clever things than evil hackers doing super-sophisticated stuff. In any case, your guess is probably as good as mine without additional info. –  Yoav Aner Feb 16 '12 at 9:13
add comment

I would be interested in seeing the file extension, and perhaps the HTTP headers of the site you're mentioning. Is it actually Ebay.com? How can I reproduce this? More detail would be appreciated.

One way this could be useful is to limit the scope of vulnerability for certain "same origin" attacks present in Javascript, Flash, and other brower plug ins.

For example, images infected with Gifar, or infected documents may invoke javascript to "do things" with data on the same DNS domain. A simple way to protect against this is to serve the files from a different DNS domain.

Examples:

https://96a077f305f5720221b338863ea8e3d7.userfiles.com/tech/SecurityPolicy.docx - OK
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/budget.xls - OK
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/Budget.xls  - Fails MD5 Checksum
https://fd4929a6ea48f85130f5a43f89cb7dd6.userfiles.com/Accounting/forecast.xls - Fails MD5 checksum

See some more implementation details here

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.