Communication mechanism (Comms)

There are four main types of communication mechanisms found:

Java JAR
There is also one known instance where a .zip extension was used! web.archive.org/web/20131101104829*/http://plugged-into-news.net/weatherbug.zip as:
```
<applet codebase="/web/20101229222144oe_/http://plugged-into-news.net/" archive="/web/20101229222144oe_/http://plugged-into-news.net/weatherbug.zip"
```
JAR is the most common comms, and one of the most distinctive, making it a great fingerprint.
Several of the JAR files are named something like either:
- meter.jar
- bandwidth.jar
- speed.jar
as if to pose as Internet speed testing tools? The wonderful subtleties of the late 2000s Internet are a bit over our heads.
All JARs are directly under root, not in subdirectories, and the basename usually consist of one word, though sometimes two camel cased.
JavaScript file. There are two subtypes:
- JavaScript with SHAs. Rare. Likely older. Way more fingerprintable.
- JavaScript without SHAs. They have all been obfuscated slightly different and compressed. But the file sizes are all very similar from 8kB to 10kB, and they all look similar, so visually it is very easy to detect a match with good likelyhood.
Adobe Flash swf file. In all instances found so far, the name of the SWF matches the name of the second level domain exactly, e.g.:
```
http://tee-shot.net/tee-shot.swf
```
While this is somewhat of a fingerprint, it is worth noting that is was a relatively commonly used pattern. But it is also the rarest of the mechanisms. This is a at a dissonance with the rest of the web, which circa 2010 already had way more SWF than JAR apparently.
CGI comms

These have short single word names with some meaning linked to their website.

Because the communication mechanisms are so crucial, they tend to be less varied, and serve as very good fingerprints. It is not ludicrous, e.g. identical files, but one look at a few and you will know the others.

Table of contents
- CGI comms Communication mechanism
  - CGI comms variant CGI comms
  - SSL certificate CGI comms

CGI comms

0 0

We've come across a few shallow and stylistically similar websites on suspicious ranges with this pattern.

No JS/JAR/SWF comms, but rather a subdomain, and an HTTPS page with .cgi extension that leads to a login page. Some names seen for this subdomain:

secure.: most common
ssl.: also common
various other more creative ones linked to the website theme itself, e.g.:
- musical-fortune.net has a backstage.musical-fortune.net

The question is, is this part of some legitimate tooling that created such patterns? And if so which? Or are they actual hits with a new comms mechanism not previously seen?

The fact that:

hits of this type are so dense in the suspicious ranges
they are so stylistically similar between on another
citizenlabs specifically mentioned a "CGI" comms method

suggests to Ciro that they are an actual hit.

In particular, the secure and ssl ones are overused, and together with some heuristics allowed us to find our first two non Reuters ranges! Section "secure subdomain search on 2013 DNS Census"

Some currently known URLs

If we could do a crawl search for secure.*com/cgi-bin/*.cgi that might be a good enough fingerprint, maybe even *.*com/cgi-bin/*.cgi. Edit: it is not perfect, but we kind of did it: Section "secure subdomain search on 2013 DNS Census".

CGI comms variant

0 0

Later on, we've also come across some stylistic hits in IP ranges with apparent slight variations of the CGI comms pattern:

Since these are so rare, it is still a bit hard to classify them for sure, but they are of great interest no doubt, as as we start to notice these patterns more tend to come if it is a thing.

SSL certificate

0 0

The CGI comms websites contain the only occurrence of HTTPS, so it might open up the door for a certificate fingerprint as proposed by user joelcollinsdc at: news.ycombinator.com/item?id=36280801!

crt.sh appears to be a good way to look into this: