Mangled URL Parameters in IE9

Question

I'm seeing mangled URL parameters coming from IE9 desktop clients. The links are sent via email, and all of the mangled URLs come from the plain-text version of the email.

I'm almost sure that it has nothing to do with my stack (django, nginx, mandrill) The values for the parameters have characters exactly transposed. The original character is the mangled one minus 13 places (eg. rznvy_cynva = email_plain, ubgryfpbz = hotelscom).

Here is one example of a mangled request that came through:

GET /book/48465?sid=rznvy_cynva&order=q09362qs55-741722-442521-98n2-n88s4nnr87192n&checkOut=07-17-15&affiliate=ubgryfpbz&checkIn=07-16-15 HTTP/1.1" 302 5 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 

• All of the requests with mangled URLs have the same user-agent as the example.
• The IP addresses associated with the mangled URLs aren't restricted to any location.
• Looking up the user-agent, this seems to be restricted to desktop Windows 7, IE9 users.

Sloatman

related: #27674231 – Sloatman

Nice find! Definitely looks related. – Wittenburg

Answer 1

It is anti-malware software on your recipients' computers. It gets the links and scans your pages for any possible vulnerabilities. It uses rot13 obfuscation to ensure that it doesn't take any unwanted actions ("buy now", etc.).

https://security.stackexchange.com/questions/48684/help-investigating-potential-website-attack-url-rewriting-and-rot-13-obfuscatio

The solution is to track down what anti-malware software / company is performing the scans, and get your site whitelisted if possible.

Mahout

Answer 2

This is going into the realm of speculation, but I'm also guessing you cannot get any answers which don't, so here goes ...

The rot13 encryption does not look like an accident. I have two guesses to offer;

1. Somebody is sharing their email and obfuscating query parameters in links so as to break the "order now", "unsubscribe" etc links while maintaining the overall integrity of the email messages. Maybe this is a feature of a spam-reporting tool or similar?

2. Alternatively, the queries are made from within a test network where users are not supposed to click on links, but the tools in there need pretty much unrestricted Internet access; so the admin set up an HTTP proxy which rewrites the query URLs to dismantle most GET transactions with parameters. (POST requests I guess would still probably work?)

Your observation that the IP addresses seem to be nonlocalized somewhat contradicts these hypotheses, but it could just mean that you are looking at TOR endpoints or similar.

Wittenburg

I'm almost sure that the links are being obfuscated by entirely separate, unrelated users. Also, the problem is pretty common, and with a volume of a few thousand users this happens about 3% of the time. – Sloatman