Know Your Enemy Lite:
Proxy Threats - Port v666

A common assumption within the network and security community is that Network Address Translation (NAT) and filtering devices such as routers and firewalls provide protection from direct inbound attack and control. Networked systems behind devices of this type are usually assigned private (non-routable) IP addresses and may be screened from arbitrary inbound connections which prevent attackers from initiating connections to these presumed 'protected' network assets. To bypass this perimeter defense, attackers have depended on malware to infect the host systems and initiate an outbound connection to a command and control system, perhaps becoming part of a botnet to wait for and then execute commands. The Honeynet Project is studying a different technique that is becoming increasingly widespread in the criminal community. Criminals are leveraging systems behind these security devices as reverse tunnel proxies and are able to perpetrate criminal activities that include sending spam email, attacking web applications, or even targeting internal private network assets.

In this paper we will detail: the basic operational concept of how these reverse tunnel proxies work, one such control protocol in use, the advantages to the criminal community, a detailed example and it?s similarities to legacy SOCKS protocols, and how this activity can be further identified including mitigation strategies.

NOTE:This paper is our first LITE paper. KYE LITE papers are shorter papers that focus on very specific topics, they do not cover the technical breadth of our typcial KYE papers. This paper is our first attempt at this.

Download .pdf version          View .html version