Re: Preventing tunnels through HTTPS proxies

On Wed, 2009-06-17 at 12:48 +1200, Michal Ludvig wrote:
I wonder how to prevent these abuses? Clearly the traffic pattern for a
VPN will be distinguishable from a genuine HTTPS traffic - but how to
detect it? Alternatively playing a man-in-the-middle on the proxy,
decrypting all the traffic, inspecting that it's indeed HTTP and
encrypting back with a key signed by a private CA that all the desktops
in the corporation would trust may be another option. Any other ideas?

You know, of course, that HTTPS was made so such tampering would be made
impossible, right? How would you want to re-encrypt the traffic _with
original server's private key_? It's not only the matter of trusting the
CA, but also the matter of the stuff in SSL certificate matching the
actual server parameters.

It would, in fact, be enough to learn that it was a VPN traffic
afterwards, we don't necessarily need to kill the tunnel in realtime
(although it would be nice). Since this kind of proxy abuse is forbidden
by the company IT policy the trespasser's managers would deal with it at
the HR level anyway. However net ops will have to provide some evidence.

In general, such thing is kinda impossible. Even if (and I'm too lazy to
look up the SSL handshake procedure) you were able to distinguish SSL
traffic from other data, there is always the simple possibility of just
connecting thru SSL-ed link and pumping your data in there instead of
just CONNECT-ing to a dumb non-SSL proxy. (and I wouldn't be too sure
that those proxies aren't working that way).
How can you tell HTTP traffic over SSL connection from any other
protocol over that SSL connection? You can't - that's the whole purpose
of using cryptography here.

--
\.\.\.\.\.\.\.\.\.\.\.\.\.\ Hi, my name is Any Key. Please don't hit me!
.\.Kruk@xxxxxxxxxxxxxxx\.\.
\.http://epsilon.eu.org/\.\
.\.\.\.\.\.\.\.\.\.\.\.\.\.


------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both Instructor-Led and Online formats is the most concentrated exam prep available. Comprehensive course materials and an expert instructor means you pass the exam. Gain a laser like insight into what is covered on the exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------

Relevant Pages

  • Re: How to pass through a SSL connect by a http proxy?
    ... >>I have made a http proxy and I found it doesnot support SSL ... >>1.how to dectect SSL connection? ...
    (comp.security.misc)
  • Re: ISA 2004 Server Errors
    ... Tunneling SSL Through a WWW Proxy ... CONNECT is really a lower-level function than the rest of the HTTP methods, ... Through ISA Server ...
    (microsoft.public.isa)
  • Re: ecommerce / ssl over 3g ?
    ... Yes, they could - but as I said, it depends on how they have their proxy set ... IIRC, as SSL is initiated, the client requests a key from the site. ... > If you have an SSL certificate that identifies itself as "mysite.com" ...
    (uk.telecom.mobile)
  • Re: HTTP Network Programming Issue
    ... which requires Cookie, Authentication and SSL at the same time, while going ... through a proxy that also requires authentication. ... You should set credentials on the HttpWebRequest as ... I think the site may use cookies, ...
    (microsoft.public.dotnet.languages.csharp)
  • Reverse Proxy and SSL configuration problems ...
    ... We are trying to setup WSS, ... proxy and SSL. ... All lists I have seen includes wide ranges of ports for the AD ...
    (microsoft.public.sharepoint.windowsservices)