How To Evade URL Filters With (Not-So) Fancy Math

Trailrunner7 writes "In their constant quest to find new and interesting ways to abuse the Internet, attackers recently have begun using an old technique to obfuscate URLs and IP addresses to bypass URL filters and direct users to malicious sites. The technique takes advantage of the fact that modern browsers will allow users to specify IP addresses in formats other than base 10. So a typical IP address that looks something like this — 192.10.10.1 — can also be written in base 8, hexadecimal or a handful of other formats, and the browser will recognize it and take the user to the specified site. What is interesting though is that due to the relative obscurity of using such methods to denote an IP or URL, it is quite feasible that existing security products do not correctly identify the URLs as valid or flag them as malicious when they point to existing known bad websites."

Comments

Technical details here

[TSHTF]

The linked article is next to worthless. The real details are in this blog post.

Re:Technical details here

[TheRaven64]

OpenDNS is irrelevant. These are IP addresses, they are not domain names, so they don't need to go via DNS to be resolved. None of the links works in Safari on OS X either, but you can ping the IPs in the terminal, so it appears to be a bug (or 'security feature') in libcurl, which is what Safari uses for resolving URLs (earlier versions used CFURL, now WebKit uses libcurl directly). Checking this in the terminal shows the problem is actually deeper; libcurl passes the address to getaddrinfo(), but that fails. Trying the same command on GNU/Linux works correctly, so the glibc implementation of getaddrinfo() does handle this kind of resolution correctly. I presume that on OS X the ping utility handles its own address parsing; telnetting to 0x42.0x66.0x0d.0x63 fails in the host lookup stage.

Yeah But...

[Greyfox]

I actually preferred using a url with the 10 digit number that was my base 10 IP address in E-Mails as it got people's attention in an otherwise bland sea of domains. This has been a feature of libc as long as I can remember (in Linux you should be able to ping an IP address in some other number base) but Firefox actually makes an effort to disallow using IP addresses with this notation. So if they're using Firefox, it won't work so well.

Big problem

[Bogtha]

The problem with this approach is that the requested URL doesn't provide a hostname, just the IP address. As IP addresses are in short supply, it has been an extremely common practice for years to assign multiple websites to a single IP address, otherwise known as name-based virtual hosting. This is common even for large companies. When you specify the URL with an IP address, the browser doesn't provide an appropriate Host: HTTP header, so any web server set up this way won't know which of the many websites it hosts should be returned. This means that anybody browsing the web with this technique will find that some websites work and some won't, seemingly at random to them.

Welcome to the 20th century

[Dachannien]

I'm glad Slashdot is here to tell us about these things, or else I might not have found this important security bulletin.

Get prepared to have your mind blown

[gqx]

The author apparently does not realize this, but you can also partly concatenate octets and mix various notations:

http://0x4a.8196963/

And yes, congratulations on being cutting edge: this thing is so old and well-known that it's even explicitly covered in RFC 3986, section 7 ("Security Considerations"), subsection 7.4 ("Rare IP Address Formats").