Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Someone in management has suggested that our proxy has been hacked by someone on the inside.

Our proxy is set up to log each user as they access the Internet, but someone has reason to believe that at least one person has found a way around it.

My manager has approached me, and asked if that were possible. So, I'm here to find out.

I looked in our proxy logs, and there is one entry entitled "anonymous" - but I do not know how if someone is using that or how they would even get the password for it.

I located the article Is it ethical to hack real systems? on here. First, I do not have anything written from him saying I can do this, but I want to come back to him letting him know if it were possible and how someone might be going about it.

Does anyone know if it is possible?

If someone did find a way around our proxy (so that they would not be logged or so they could access blocked websites), would they most likely be doing it through the anonymous account or by getting around the proxy another way?

share|improve this question
    
What are you using for your proxy? Log files are important. –  GregD Sep 17 '09 at 19:33

9 Answers 9

up vote 0 down vote accepted

Also be aware the user could be utilizing something like Remote Desktop or VNC and simply connecting to a different system. A web proxy doesn't come into play in those situations, and the user would be able to access whatever they felt like. While it might violate use policy, it isn't outright malicious either.

share|improve this answer

There are many ways around proxies. You'll never manage to completely stop someone.

May I suggest that you remind all your staff that circumventing your filtering is a disciplinary matter and that anyone caught bypassing it will be dealt with accordingly. Then if you happen to catch someone by looking at their screen, you can deal with them.

share|improve this answer
2  
+1 for 'remind your staff' That may be all it takes..and maybe the offender will understand that you are catching on to what he is doing. –  cop1152 Sep 17 '09 at 19:45
    
People have been let go for things like this already. It could just be the whole anonymous thing that "squillman" indicated. Also, we have VNC installed on most machines like "Sibster" pointed out. I'll point my manager in these areas. –  jp2code Sep 17 '09 at 22:01

Our proxy is set up to log each user as they access the Internet, but someone has reason to believe that at least one person has found a way around it.

They might have just used their own proxy for that. Your servers would only see the user connecting to his own remote system. (And as someone who believes logging browsed pages is evil, I do know quite a few ways to do that.)

share|improve this answer

Anything is possible.

First, find out if your manager wants you spending time on investigating this issue. Send an e-mail so you have written confirmation you have permission to proceed.

What is the proxy your company is using? There are probably known exploits to get around it. Can you disable the "anonymous" account or disable anonymous access to the proxy?

Are your edge firewalls blocking http traffic that does not originate from the proxy? If not, getting around the proxy is as simple as not using a proxy.

Another way to get around it would be to use an SSL tunnel to an external proxy, and surf from there. This is much harder to detect and prevent.

share|improve this answer

If it's because someone goes on websites that you blocked, they may have been using some kind of tunnel, like a SSH tunnel.

This Google search gives you many ways to get around proxies.

As for the logs...can't help much since I don't have the whole history.

share|improve this answer

There are plenty of ways around a proxy.

Any of the anonymizer sites on the web will let you bypass a proxy blacklist if they are not themselves on the blacklist.

Easiest would be something like PHPPROXY on an external server. This, however, would be fairly easy to detect in the log files.

Harder would be the above mentioned ssh tunnel but also harder to find.

Another option would be a VPN connection to the outside world. There a a few sites that rent VPN connections for a fee.

share|improve this answer

"Getting around the proxy" =/= "hacking the proxy".

Yes, it's trivial to get around most proxies.

share|improve this answer
    
I didn't know what to call it. It seems like hacking to me. Thanks for the clarification, though! –  jp2code Sep 17 '09 at 21:54

In addition to what everyone else already stated about subverting your proxy...

Depending on your proxy, that Anonymous entry in the log file could just be the initial request from the browser before it knows it has to provide proxy authorization.

If the HTTP response code for that entry is 407 (proxy authorization required) then this is probably the case, and should be followed pretty quickly by another authenticated request (assuming the client has authorization) for the same resource from the same IP. If it's not followed by another request for the same resource from the same IP then it's possible that the client just bailed on the session prompted for proxy authentication.

share|improve this answer

First off - Yes, of course it's possible. Why not use something like Wireshark to see what is moving on the network? As long as you are monitoring from an appropriate point on the network you'll see what traffic is bypassing the proxy and where its going.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.