Attackers Employ Diverse and Obfuscated User Agent Strings in Scans
Honeypot logs reveal attackers are using a wide array of User Agent Strings (UAS), including variants of common scanning tools, attempts to exploit UAS parsing, and even malformed entries.
Security researchers monitoring honeypots have observed a fascinating and sometimes alarming diversity in the User Agent Strings (UAS) employed by network scanners. These strings, typically used by web browsers to identify themselves to servers, are being weaponized or manipulated by attackers to obscure their activities, test system defenses, or even attempt to exploit vulnerabilities.
The logs showcase a variety of tactics, from scanners mimicking legitimate tools to those explicitly advertising their scanning nature. Variants of the popular masscan tool are frequently identified, often with "scan" embedded directly in their UAS. This direct naming, while seemingly straightforward, can help attackers quickly identify potential targets or test specific scanning configurations.
Beyond simple identification, some attackers are attempting to leverage the way servers parse UAS. The enduring presence of "Shellshock" in UAS, despite the vulnerability being over a decade old, suggests that some systems may still be susceptible to or are being tested for this legacy exploit. This highlights the persistent threat of older vulnerabilities being revisited by attackers.
Furthermore, the logs reveal a more sophisticated approach where attackers utilize entire lists of UAS. In these scenarios, the scanning tool cycles through a predefined set of strings for each request. This technique aims to evade detection systems that might flag repetitive or unusual UAS patterns. However, a lack of proper sanitization in these lists can lead to unexpected results, with separator lines from the list files themselves being sent as UAS, indicating a degree of sloppiness or haste in their preparation.
Some UAS entries even include contact information, such as URLs or email addresses, offering a direct line to the individuals behind the scans. While this might seem counterintuitive, it could be an attempt to foster communication, provide feedback channels, or even serve as a form of digital bragging.
The observed UAS also point to specific scanning interests. One notable example includes strings indicative of scanning for servers that stream GPS correction data via the NTRIP protocol, even including NTRIP headers within the request. This suggests targeted reconnaissance for specific types of infrastructure.
Overall, the analysis of these honeypot logs underscores the dynamic and often creative nature of network reconnaissance. Attackers are continuously evolving their methods, using UAS not just as identifiers but as tools for evasion, exploitation, and targeted probing, forcing defenders to remain vigilant against a constantly shifting landscape.