The Dark Side of the Web: An Open Proxy’s View Vivek Pai, Limin Wang, KyoungSoo Park, Ruoming Pang, and Larry Peterson Princeton University

CoDeeN (Content Distribution Network) PlantLab’s network of open web proxies Used for forward and reverse proxying Free and open to anyone Motivation: provide a secure open proxy that anyone can use for community caching or avoiding censorship. Live testing on the internet helped developers quickly find bugs and security problems.

Security Problem #1: Spam Spammers used CONNECT method to build TCP tunnels to port 25 on remote hosts. POST/formmail often stores destination address in hidden input fields. Spammers exploited forms by inserting their recipient’s e- mail address into these forms. IRC spim via CONNECTs to port 6667

Security Problem #2: Anonymity Some users were going to SpotLife to download webcam images and used CoDeeN to mask their identity. Asian users downloaded movies via CoDeeN’s west coast servers (Asia-US- Asia) to bypass ACL restrictions. Users used stenography to embed content inside other files (parts of movies inside gifs and jpegs).

Security Problem #3: Abuse Users used CoDeeN to launch dictionary attacks against Yahoo accounts. Users built Google crawlers on a series of words. Click-Counter abuse. Some click counters use page views instead of ad views, inviting abuse.

Security Problem #4: Content Theft CoDeeN often run at universities which may have address authenticated site licenses for electronic journals. One user downloaded over 50K articles. Some sites allow private content for local users only (ACL based). Users exploited CoDeeN server locality to gain access to these files.

Security Problem #5: Blacklists Due to these abuses and their status as an “open proxy”, many CoDeeN hosts were getting blacklisted, reducing the network’s usefulness.

Solutions/Countermeasures Users classified into 3 groups: local CoDeeN users, local to PlantLab hosts, and outside users. Outside users were rate limited CONNECTs to port 25 and 6667 were disallowed. POST methods were disallowed. Blacklists were used to shut out malicious users.

Yahoo login attempts limited to 30 per day. Specific vulnerability signatures charged users with a full day’s worth of traffic (locking the user out for a day). Cache misses were sent to a pair of proxies (forward and reverse) so that a user’s aggregate bandwidth could be tracked. Licensed content (e-journals, etc...) made available to local users only, outside users got an error page.

Results CoDeeN now serves over 59,000 users at up to 50K requests per hour. Denying POST methods has not been a significant problem. Rate limiting yahoo logins and aggregating user totals across proxies has greatly reduced password cracking attempts.