Intercept and modify analytics to improve client app behavior experience
By: Dennis Chow
Tags: Cybersecurity, Network Security, Analytics, Data Privacy, Cookies

Have some of you out there experienced adverse affects when attempting to block things like advertisements, analytics traffic, and other similar things? I bet so, some websites will tell you to disable your attempted blocks. Or, how about that the content either doesn’t load correctly anymore or loads incredibly slow? Experiencing this on your “smart” devices, IoT’s (Internet of Things), and even mobile apps is extremely frustrating and may even ruin your experience using the product or service. But what can you do if you can’t block? Fake it out.

What’s happening?

Data is being generated on pretty much every piece of modern technology you utilize today. Then, when connected to the Internet through some means, it sends out data about you or attempts to go seek provide you content based on metadata about you or for purposes of revenue (like advertisements). Sometimes you can see it obviously via advertisements and sometimes in not so obvious ways. For example, your favorite site always seems to know what to suggest to you, even if you haven’t bought anything in a while. Other data tracking methods aren’t so obvious and you can’t see them.

External reference example: Smart TV spying

Why does my App or Device X act strange, go slow, not load correctly, or explicitly tell me to unblock something?

Simply put, there is code usually in the form of scripts or other functions that monitor for responses and perform actions based if a response happened or didn’t happen. These are also known as render blocking scripts and synchronous scripts. Regular methods of plain “blocking” something like a known advertisement site or other portion of the product or service you’re may cause delays, failures to load, or other unexpected behavior because your service or product is expecting that advertisement or a response from a server somewhere to tell it something.

How do we fix this? Faking out the response to your product or service. (Technical Brief)

This is where things get technical. For those of you who want to understand how this works, a bit of reading on subjects like HTTP communication and status codes, basic malware behavior, packet capturing, javascript tracking, and DNS redirection are needed. For those of you who already know about these concepts or just want to see my method for solving this: ignore the above reading suggestions and barge on through.

As I was doing some reading for some other projects; I came across a page that described a KISS (keep it simple stupid) method instead of emulating a whole command and control specific server. Straight from the ncat (makers of nmap) page itself:

Turn Ncat into a simple web server Continuing the example from the section called “A Listen Mode Example”, we can create a simple HTTP server that serves the file using the following command: nc -lk -p 8080 — sh-exec “echo -e ‘HTTP/1.1 200 OK\r

’; cat index.html” Or, if you’re a Windows user: ncat -lk -p 8080 — sh-exec “echo HTTP/1.1 200 OK& echo(&type index.html”

First, figure out traffic that you need to block. A simple packet capture (pcap) or HTTP headers capture may do the trick for you. One example using the pcap method is what this blogger did regarding his Smart TV.

Next we need to utilize a method for DNS redirection. If you don’t have your own internal DNS server; you can use something like DD-WRT, Pfsense, or IPFire at home — you can override any DNS look ups to a particular IP on a simple static A record. There are other methods like using HOST files and DNS poisoning but that’s more trouble than it’s worth in many cases and you probably can’t go around installing a host file on some of your embedded devices.

In Pfsense, you can override your typical DNS forwarder under the Services > DNS forwarder area:

Now setup/install your ncat listener and either do a standard HTTP 301/302 redirect or a 200 OK which you can have your own custom page to feed back to the client. You might even be able to load up a client side exploit and see what happens.

Notice, the example is different from the web page. in how I utilize the ampersand and the existing dos commands for type. ncat will use it in the standard way dos is interpreting it from the shell. Note that in Windows there really is no native command substitution in dos and native use of “\r

” for the new line return; so just chaining echo/type again will create the new line in the response. Of course, we use our standard ncat switches (-lkv) listen, keep connections open, verbose (-4) for using IPv4 only (up to you) -p (which port is open and you’re able to use, naturally you want to set this to whatever your app/product is using commonly 80 and or 443) followed by (-c) for executing the command. By default, ncat is using TCP; you may have some strange instances where traffic is sent out via UDP. Use the switches accordingly. Oh, and obviously replace your loopback address with whatever computer you’re going to run this on to intercept/interact with your app or device.

Now test using a standard browser; I was able to successfully either redirect the client to something like google.com or use your own page. Think of all the new possibilities you can dig into when interacting with the app or device.

That concludes the mini weekend solution for being able to fake out certain analytics that require some sort of response to properly work. I know some of my devices work better in terms of speed and loading. Try it out for yourself.

Disclaimer: The methods I discuss are for a technical audience. These methods meant for educational and testing purposes. Using these methods may violate your license or end user agreement with the service or product you’re performing this on.

Find out about more ways to bolster your cyber defense operations at: www.scissecurity.com