#Redacted com windows#

User-Agent: Mozilla/5.0 (X11 U Linux i686 en-US) Gecko Ubuntu/9.10 (karmic) Firefox/3.5.1 For instance, this request made the site think the person is connecting from a Linux platform:

#Redacted com windows#

The Koobface website above also paid attention to the User-Agent field of the HTTP header, attacking only visitors coming from the Windows platform. This is a defensive strategy to make it harder for security analysts to investigate the The User-Agent Field of the HTTP Header However, many websites will only attempt to attack the visitor if the Referer field is set to a particular value, such as the one corresponding to Google. This particular site didn't seem to care about the specific contents of the Referer field, as long as it was set. This one attempted to social-engineer the person into downloading and installing malware under the guise of a Flash player update: In contrast, when the victim clicked on a link embedded in some page, the 'Referrer' field was set:Īs the result, the website redirected the visitor to another page. User-Agent: Mozilla/4.0 (compatible MSIE 8.0 Windows NT 5.1)īenign response from the website looked like this when rendered by the browser: HTTP request headers when visiting the malicious page directly, without a referrer: If the victim visited the malicious website directly by typing the URL into the browser, the website would redirect to an apparently benign page that looked like Google news search results. The Referer Field of the HTTP Headerįor instance, Websense documented a recent Kookface variant whose website looked at the Referer field of the HTTP request. When connecting to malicious websites to investigate them, take care to set your User-Agent and Referer headers according to the attacker's expectations. There are a few other connection elements they need to account for.

They also take care to conceal their origin, perhaps by connecting using a non-corporate DSL line or by using an anonymizing proxy, such as Tor. Incident responders sometimes need to investigate the nature of a website reported as being malicious. They do this by connecting to the remote site, while taking care not to infect themselves, perhaps by using a laboratory machine that isn't connected to the production network.