RE: [fw-wiz] httport 3snf

From: Dawes, Rogan (ZA - Johannesburg) (rdawes@deloitte.co.za)
Date: 10/21/02 

From: "Dawes, Rogan (ZA - Johannesburg)" <rdawes@deloitte.co.za>
To: "'Robert E. Martin'" <rmartin@fishburne.org>, firewall-wizards@nfr.com
Date: Mon Oct 21 13:42:01 2002

Require authentication for outgoing SSL requests through your proxy server.

Log excessive requests to a particular server. Excessive by number of
requests, as well as by data volume. This becomes particularly relevant if
you can do it by userid, if you are authenticating requests. Students making
use of httport will typically only show a single site in their request
lists, since all outgoing requests will be tunnelled through that site.

Also consider monitoring how much data is *sent* as part of the request if
you can. Typically web surfing has a very low sent/received ratio.
Connections/requests that are higher than average may indicate different
protocols being tunnelled.

Also, identify the public httport servers (from the web site), and put
explicit block rules in your proxy or firewall.

Try using something like ngrep on port 443 for strings that httport uses as
part of the protocol. This is the one most likely to achieve the results you
need, but would involve setting up a client, a host, and a sniffer to
determine what those strings are.

Of course, if the traffic is encrypted, as they seem to offer, you could try
running ssldump with the keypair supplied with the software. (I assume it is
SSL compatible, if not, you're out of luck on that one) See above Re traffic
analysis.

Finally, and this should really be the first action, update your policy to
make "bypassing firewall restrictions" a punishable offence.

Good luck.

Rogan

> -----Original Message-----
> From: Robert E. Martin [mailto:rmartin@fishburne.org]
> Sent: 21 October 2002 03:57
> To: firewall-wizards@nfr.com
> Subject: [fw-wiz] httport 3snf
>
>
> Hi there.
> We run Redhat 6.0 with ipchains and have been able to block AIM and
> others with this system quite effectively, however, our students here
> have discovered HTTport 3.snf to bypass our proxy server using a SSL
> connection. Is there a way to stop this without bringing the
> rest of the
> newtork to it's knees? I have been unable to sniff the packets
> successfully enough to find out what ip address the host ssl
> server is,
> but I am able to launch the program on my local machine, sniff the
> packets and see that the first thing that happens is a DNS
> Request. Can
> I block DNS requests for a specifid url, ipaddress or other entry via
> IPCHAINS?
>
> Thanks for your time.
>
> --
> Robert E Martin
> IT Manager
> Fishburne Military School
> rmartin@fishburne.org
> 540.946.7726
>
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@honor.icsalabs.com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
>

Relevant Pages

  • Re: encrypt password for webservices
    ... When you say about limitation of IIS/SLL (I assume it should be SSL) ... > 3) Requests can be multi-threaded, and some requests can even be droped if ... which allows the server to find appropriate EncryptionKey ... > encryption. ...
    (microsoft.public.dotnet.security)
  • Re: What doesnt lend itself to OO?
    ... > system design within that context seriously). ... >>The first line exists in the server. ... > objects between client and server i.e. as far as the client code is ... the message data packet data in the server between requests, ...
    (comp.object)
  • Re: does XMLHTTP work over SLL
    ... and I could use client side vbscript (we require our users to use IE6) ... I could just send the requests off and have them write back without ... I did read in some documentation that it doesnt work over SSL (wish I ... server, but WOULD NOT work on SSL server ...
    (microsoft.public.scripting.vbscript)
  • Re: [patch 00/13] Syslets, "Threadlets", generic AIO support, v3
    ... I have an embedded server I ... I/O, audio, and child processes that handle VoIP signaling protocols ... want to throttle the concurrency of requests at the kernel level *for ...
    (Linux-Kernel)
  • Re: HttpListener BeginGetContext does not seem to handle more than 2 request simultaneously
    ... my server ran just fine and seemed to ... be aceepting/processing multiple requests simultaneously. ... System.OutOfMemoryException: Exception of type ... K> PR2 2 ...
    (microsoft.public.dotnet.framework)