1

If your computer is infected, apparently Google will tell you so - as shown in the image below:

Your computer appears to be infected

According to this article, Google use HTTP headers to work this out. But how do they do it, what sort of headers should we look for?

Thank you!

6
  • That seems interesting. Can you debug what request is being send by your browser.
    – Ashwani
    Aug 11, 2013 at 5:49
  • 1
    That page doesn't mention headers at all. On the contrary, it says that they check if the request comes from an IP address associated with a known proxy.
    – icktoofay
    Aug 11, 2013 at 5:49
  • My computer isn't infected, so not really. I read about it in a magazine. Sorry @icktoofay, let me find the right article. Aug 11, 2013 at 5:50
  • I can't find the right article, though this article (krebsonsecurity.com/2011/07/…) says it uses a unique signature. What is this signature? Aug 11, 2013 at 5:52
  • I'm not sure if anyone without access to the code could tell you. Without an official response or seeing the code, it's just speculation.
    – icktoofay
    Aug 11, 2013 at 5:57

1 Answer 1

2

The Google Security blog post you linked doesn't mention HTTP headers.

A key point in the blog post is this:

This particular malware causes infected computers to send traffic to Google through a small number of intermediary servers called “proxies.”

And this:

...taking steps to notify users whose traffic is coming through these proxies...

Google doesn't say much about the proxies, for instance if they were standards-compliant(ish) HTTP proxies or just servers echoing the user requests.

The "unusual" traffic that originated from Google would have been from a small set of IP addresses. No special HTTP headers would be necessary. Google only had to add the warning message to pages being served to the suspect IP addresses. That's it.

The term "signature" in the the follow up link from your comments is used very informally, probably alluding to the IP addresses of the proxy servers. If you want to imagine something more complicated than that, then I suppose it's possible that these proxies (like many HTTP clients) could be detected by some pattern of HTTP headers unique to them. For example the User-Agent or Via headers, or even something more subtle like the ordering or capitalization of headers. I doubt it came to that though, and I don't see much value in speculating, especially two years after the fact.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.