Malware spoofing HTTP Host header to hide C&C communication

Posted by   Virus Bulletin on   Sep 4, 2013

Traffic appears as requests to Google or Yandex.

There have been several recent examples of malware using a spoofed HTTP Host header to hide communucation with its control servers.

When a web browser sends an HTTP request to a web server, it includes a Host header, containing the host of the site that is requested. This header has been mandatory since the introduction of HTTP version 1.1 in 1999. It allows for domain-based virtual hosting, where websites on multiple domains are hosted on a single web server.

It is trivial to spoof HTTP requests and the Host header is no exception. This is usually of little concern: depending on the way the web server is set up, the user will get a redirect, an error, or a default website. Sites such as Google, Facebook and Virus Bulletin will return a 302 redirect when a request is made for a document on a different domain, while Microsoft and Yahoo return an error. Under normal circumstances, none of this should affect the server's security.

  Connecting to the Virus Bulletin web server with a spoofed hostname will cause the web server to return a 302 redirect.

In some cases, using a spoofed Host header can be used to bypass filters that block traffic based on the content of this header. In recent months, this trick has been used by various pieces of malware.

In July, Trend Micro wrote two posts on pieces of malware that used a spoofed Google header to communicate with their command and control servers. This week, McAfee's Umesh Wanve analysed the 'Cidox' trojan which sent a fake Yandex header, making it appear as if requests were made to the servers of the Russian search engine.

Of course, one would hope that security software would block this communication based on the IP address, or the content of the traffic. But no software is perfect and a system administrator analysing server logs could easily be deceived by the spoofed Host header.

In the case of big sites like Google and Yandex, a simple reverse DNS lookup on the IP address will reveal that the header is spoofed. More generally, however, it is not so simple to determine with certainty whether the host name is spoofed.

Security software and system administrators alike should thus treat the content of the Host header in the same way as they treat a domain name appearing in an email header: if it is known to be bad, then blocking is justified on the grounds that it is either bad, or spoofed. But if it isn't, it shouldn't be assumed to be valid.

Posted on 4 September 2013 by Martijn Grooten



Latest posts:

In memoriam: Yonathan Klijnsma

We were very sorry to learn of the passing of researcher Yonathan Klijnsma last week. Here, former VB Editor Martijn Grooten shares his memories of a talented researcher and a very kind person: this month, infosec lost a really good one.

VB2020 localhost videos available on YouTube

VB has made all VB2020 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

VB2020 presentation & paper: 2030: backcasting the potential rise and fall of cyber threat intelligence

At VB2020 localhost, threat intelligence consultant Jamie Collier used the analytical technique of backcasting to look at the rise and fall of the cyber threat intelligence industry.

VB2020 presentation: Behind the Black Mirror: simulating attacks with mock C2 servers

At VB2020 localhost, Carbon Black's Scott Knight presented an approach he and his colleagues have taken to more realistically simulate malware attacks.

VB2020 presentation & paper: Advanced Pasta Threat: mapping threat actor usage of open-source offensive security tools

At VB2020, researcher Paul Litvak revealed how he put together a comprehensive map of threat actor use of open-source offensive security tools.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.