1. Proxy Servers

2. Introduction
1. Acts as an intermediary between a private network and the internet – both client and remote host think they are communicating directly, when in fact it all goes through the proxy
2. Works as a Disk Cache for faster retrieval of frequently requested information

3. Firewall vs. Proxy Server
Firewalls work at the Network layer and can block untrusted traffic
Proxies work at the Application layer – and often map internal network addresses to single IP (NAT). This makes it difficult for outsiders to access internal IPs
Can also be application specific: http – proxy, ftp-proxy, etc

4. Circuit-level Proxy Works between Application and Transport layer
Establishes a a virtual circuit between clients and untrusted hosts
Lets software work as if it had a direct internet connection instead of forcing individual setup of each application

5. Caching Works much like web browser caching, but for multiple users
Significantly speeds up information retrieval (duh!) and takes load off of actual servers
Read-ahead caching
Last-modified multiplier
Reverse caching

6. Security Features
NAT/NPAT
Packet Sequencing
Packet Filtering

7. Modern Proxy
Usually implemented inside of software suite as opposed to as a stand-alone product

8. Risks Initial configuration – remember access controls
No access controls leaves the possibility for portscans.
Worst case – allows for reverse connections
No need to portscan, however, a google search can find Open Proxies

9. Proxy Abuse
Open Proxy
Simple method (from 2002): telnet to proxy, enter GET HTTP/1.0 – if page is returned, the proxy is ripe for abuse
Anonymity value – how much does the HTTP header reveal about you?

10. Examples
[Wed Aug 21 09:00: ] x: HEAD HTTP/1.0 [Wed Aug 21 09:01: ] x: HEAD HTTP/1.0 [Wed Aug 21 09:02: ] x: HEAD HTTP/1.0 [Attacker trying to find vulnerable CGI scripts on a porn site]

11. More Examples
[Thu Aug 22 10:11: ] x: GET HTTP/1.0 [Someone testing anonymity of the proxy]
[Thu Aug 22 11:47: ] x: CONNECT HTTP/1.0 [Someone trying to hide their IP address on ICQ. Possible IM spammer]

12. The End?