The place where I work sometime is receiving some alert from the NIPS stating :

[1:30918:2] "MALWARE-CNC User-Agent known malicious user agent - User-Agent User-Agent Mozilla"

The user-agent in the paquet is :

User-Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

It is coming from some clients accessing our website. It basically changes IP address. Either that or multiple client are infected. The rule indicate that the client would be infected with some virus trying to connect to an command and control server. It's a good thing that this paquet comes from outside, because the opposite would mean that we would be infected. What I don't understand is why is it trying to communicate with us? Obviously it's not a legit navigator like chrome or firefox, but rather a script trying to look like it. Shouldn't it try to communicate with the C&C server? Does this mean that our servers are infected (or were infected at some point) with some kind of C&C hop/proxy that redirect the information?

  • It looks that the HTTP request is part of some scanning for find infected places. I will be worried if the responses of the server will be OK 200, indicating that your system probably is affected. However, you could put more information about the request and the response. Also contact with your NIDS providers or find more information of whats that malware. – camp0 Dec 13 '18 at 16:09
  • Is this a public facing websites? In that case I wouldn't worry - browsers have the right to pass any User-Agent string they want. There are browser extensions with the sole purpose of writing nonsense into the User-Agent string just to troll webmasters. Or are you talking about an internal facing website and are worried that this might be a symptom of some browser highjacker spreading within your organisation? – Philipp Dec 13 '18 at 16:15
  • It is a public facing website. The NIPS blocks the packet, so no responses from the server. But even if the server would answer OK 200, some web server doesn't check the user-agent, so I guess it wouldn't mean that we would be infected. – VBTech Dec 13 '18 at 16:17
  • @camp0 the webserver response is not meaningful. For instance a PHP script may respond with 200 OK, and yet refuse to include /etc/passwd if you attempt GET /file.php?include=../../../../etc/passwd. – vidarlo Dec 13 '18 at 16:19
  • So I guess it's either trolling or scanning for infected servers? – VBTech Dec 13 '18 at 16:20

Web clients have the right to pass any User-Agent string they like. There is no good reason to deny access just because your NIPS can not make sense of the user-agent string. If you let it do that, then you might deny access from legitimate users with non-mainstream browser configurations.

I would recommend you to configure your NIPS to stop blocking these requests, unless it can find something which is actually fishy about them. Something actually fishy could be if the string contains an attempt to do a SQL injection or XSS injection (hoping that the user-agents gets stored in a database and/or displayed in a web interface and those do not sanitize their input properly).

  • What's wierd is that all the clients come from Amazon Technologies Inc. – VBTech Dec 13 '18 at 16:31
  • @VBTech Seems like someone is running a web crawler on an AWS instance and screwed up when they implemented sending the user-agent string. There are reasons to block web crawlers, for example when they don't respect your robots.txt. But sending weird user agents is none of them. – Philipp Dec 13 '18 at 16:33
  • But woudn't it be the same IP? Are web crawler known to change IP like that? – VBTech Dec 13 '18 at 16:36
  • And I agree with you : Web clients have the right to pass any user-agent the like. But at the same time, I don't see any good reason to change the user-agent (and make it look like a browser) except scanning for infected clients. – VBTech Dec 13 '18 at 16:42
  • 1
    @VBTech When you operate a public facing webserver then you have to get used to seeing all kinds of weird stuff in your logs. When you are running a properly hardened server, then 99.999% of that weird stuff is not worth worrying about. – Philipp Dec 13 '18 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.