Vulnerabilities / Threats

1/5/2017
08:31 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ghost Hosts Bypass URL Filtering

Malware authors have found a way to evade URL-blocking systems by swapping bad domain names with unknown ones.

For some time now URL filtering techniques have provided a fairly reliable way for organizations to block traffic into their network from domains that are known to be malicious. But as with almost every defense mechanism, threat actors appear to have found a way around that as well.

Security researchers from Cyren are warning about a new tactic for fooling Web security and URL--filtering systems. The technique, which Cyren has dubbed "Ghost Host," is designed to evade host and domain blacklists by swapping bad domain names and inserting random, non-malicious host names in the HTTP host field instead.

The objective is to evade host and domain blacklists by resetting the host name with a benign one, even when the actual connection is to a malicious command and control IP, according to a Cyren blog post today.

“Ghost hosts are unknown or known-benign host names used by malware for evading host and URL blacklists,” says Geffen Tzur, a security researcher at Cyren.

“The malware will use a ghost host in the HTTP header, but actually connect to a different destination, hosted on a different IP,” he says.  This way, network security systems that inspect the HTTP "host" header will not notice the underlying connection to the malicious IP, and will allow the connection, he says.

According to Tzur, Cyren stumbled upon the new detection evasion technique while analyzing the behavior of Necurs, an especially persistent botnet that is being used to distribute spam, ransomware, and other malware.

The malicious destination IP address, to which compromised machines was being directed to, was the same as the one used for establishing the connection in the first place. But by using a ghost host, the threat actors were able to hide that fact, Tzur says.

“Since the ghost hosts have no effect on the established connection, they may be used with other IP addresses,” he says. That means there’s no way to confirm if ghost hosts are paired to the underlying IPs, he says.

According to Tzur, malware authors can manipulate HTTP requests at their will to fool URL filtering systems. They can employ an HTTP client, which connects to one malicious IP and sends HTTP requests with customized headers. The unknown hosts are inserted during request creation.

“Malware authors can manipulate the HTTP request at their will. They can employ an HTTP client which connects to one malicious IP and sends HTTP requests with customized headers,” he says. “The unknown hosts are inserted during request creation and are probably hardcoded.”

Tzur says there have been no previously reported incidents he knows of where malware actors have attempted to fool detection systems by inserting benign names in the HTTP host field.

“It is as easy as using any open source HTTP client which features header manipulation,” Tzur says, and there are multiple HTTP client implementations that allow this sort of manipulation.

Botnet owners can benefit from the technique in multiple ways. The most obvious one is that URL filtering systems will not block ghost hostnames. Cyren checked to see whether popular URL filtering systems detected the ghost host names, and none of them did.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Bluetooth Hack Affects Millions of Vehicles
Dark Reading Staff 11/16/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19406
PUBLISHED: 2018-11-21
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
CVE-2018-19407
PUBLISHED: 2018-11-21
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.
CVE-2018-19404
PUBLISHED: 2018-11-21
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= ...
CVE-2018-19387
PUBLISHED: 2018-11-20
format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service (NULL Pointer Dereference and application crash) by arranging for a malloc failure.
CVE-2018-19388
PUBLISHED: 2018-11-20
FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue.