Hinky’s Proxy Obsession

Unless something extraordinary happens today, my previous prediction of “three million proxies by the end of August” is shot down.

I have taken the time to spiff things up a bit.  I have added flags that were missing for one reason or another, including Greece (how did that get missed?), Hong Kong, some tiny island near Finland I forgot the name of, and “APAC”, short for “Asia/PACific” and a peculiarity of the Maxmind geoip database.  I had been using the flag of the Earth for missing flags, but I was tired of looking at it.

Here and there a few duplicate proxies have popped up in the List.  I scour the master database every day for dupes but some have escaped into the gold database.  Fixing that will only take a few minutes when I decide to get around to it.

Reports of “millions of infected Web sites” in the past few days have been flooding the Intertubes.  These are due to a malware widget displayed on default parked pages at Network Solutions.

According to this article the widget is dropping a Koobface variant primarily on Chinese browsers.

One potentially limiting factor in this attack was that it seemed to target Chinese Web surfers. The malicious widget caused a fake message box to pop up, similar to a message prompt generated by the instant messaging client Tencent QQ. While this chat client is by far the most popular in China, it is probably unknown to most Westerners.

It doesn’t take a genius to connect the dots on that one.

Time and time again the bozos who run proxy lists try to come up with silly JavaSHIT schemes to prevent their pages from getting scraped by list raiders like me.

Consider the following stupidity (click for a larger view):

This is silly on a number of levels.

First, anyone remotely concerned about online security (there’s a couple of us) has JavaSHIT disabled 24×7 and the last place they’d want to enable it would be on a freakin’ proxy list site.

Second, that “eval(unescape(…” bullshit screams “HAXX!!!”

Third, this code simply unescapes to the html that would have been displayed had they not obfuscated it in the first place.  What is the point?

And since it’s JavaSHIT, it’s easy to pull off the page and de-obfuscate.

I bring this up because I have been throwing out the unproductive sites I’ve been pulling data from.  Some have disappeared, including my very last, solid gold Russian proxy site.

Those are some big shoes to fill, so to replace it I Googled “proxy list” to see who’s getting all the hits these days.  For the most part it was the usual suspects, but there were a few new names so I looked into them.

And sure enough, most of them were using JavaSHIT obfuscation.  Even some of the old standby sites have been re-written to leverage JavaSHIT.

And I was surprised to find that I could actually get some good proxies from these sites.  THAT in itself is very unusual.  Typically you go through the hassle of unobfuscating this crap and it’s seldom worth the effort.

As usual, you’re the WINNER!

I have a lot of security delicacies “on my plate” but SPAM isn’t one of them.  Back at the salt mines, that’s someone else’s problem.  Suffice to say I’ve ignored the subject for years, considering it’s fairly well handled by all the Web mail accounts I have floating around (Yahoo, Hotmail, Gmail, et cetera).

I never even look at the stuff.

However, there is this woman – let’s call her “Helen Dink” – who is no relation to me but by some strange quirk of fate we share the same ISP.  She believes her e-mail address is hdink@myisp.com, but it’s not.  That’s my email address.  I’ve had that address for almost ten years now, but whenever she goes to fill out Web forms online she plugs in my email address!

So I get a lot of her email.

This has been going on for at least five years.  I know more about this woman than I want to (yes, she’s a Facebook user).  Her friends constantly send me email about a variety of crap, from Girl Scout meeting notices to recipes and the like.  It’s incredibly annoying and for the past few years I’ve been writing them back and letting them know, in no uncertain terms that I am not “Helen Dink” and to please remove my email address from their “Contacts” folder.

So today I got an email from “Andrea Wilson”, a normal-sounding American name.  Thinking it’s one of Helen’s buddies I open it up in order to send my standard reply to these things.

But it’s not.  It’s a 419 scam email…

I am Golan Bradley a staff of Natwest Bank ,I am pleased to pass across to you a very urgent and profitable business proposal which I believe will profit the both of us after completion.I will await to receive a positive response from you to enable me give more details Please send your confidential telephone and fax number in your reply to: golan.bradley@removed.com Golan Bradley(Mr.)

The security wonk inside me kicks in and I decide to look at the SMTP headers, thinking I’d be able to track it back to Nigeria or Cameroon (hi, fellas!).

But the headers were extremely legit.  The email went through 2 Exchange servers, a Symantec Brightmail Gateway (an anti-SPAM device), and a ZIX encryption device before ending up at my ISP.

“Andrea Wilson” turns out to be a Real Person™  who works at a hospital in Texas.  And, not surprisingly, she’s an active Facebook user.  Obviously her workstation or laptop or whatever had been summarily pwn3d and was being used to deliver 419 SPAM for person or persons unknown.

Well, that’s her problem.

I briefly toyed with the idea of writing her back and suggesting she have the IT department check out her box, but that’s a notoriously bad idea and generally frowned upon (this comes from the heyday of email viruses, when sending a “HEY ASSHOLE YOUR COMPUTER HAS A VIRUS” email only served to exacerbate the problem).

Maybe I’ve been away from SPAM for too long, but it seems unusual to see legitimate SMTP headers from an obviously corporate environment, considering that lately the vast majority of SPAM comes from Yahoo, Gmail, Hotmail, et cetera.

Everything old is new again.

I got bored with snort and intrusion detection a few years ago.

The last thing I did with snort was try to code a netfilter detector/packet killer for one of Luigi’s UT99 hacks.

It was an epic FAIL.

I even read the docs!

But back in the day I ran snort & ACID (now BASE – how clever) on a number of boxes, both at work and at home.  I got very tired of seeing all those false positives, every day, day after day after day.  And then reading in the snort online docs that a particular rule I was unfamiliar with had “no known” false positives or negatives.

Riiiiight.

And then snort went commercial.  Well, good riddance.

So it’s been at least three years since I touched it.

Suddenly, out of nowhere, my boss the Security Thought Leader decides snort has to be deployed throughout our organization on every-fucking-thing that can run it.  And since I was stupid enough at one time to open my mouth and let the word “snort” fall out of it, it’s my problem.

Lo and behold we’re now up to snort v2.8.6.1.  And it turns out to be a bad time to be implementing snort.

As of June 2010 (Hey!  That’s like… now!) a lot of the old freeware utilities for managing snort are obsolete.  Not that they were any good, but their very existence was helpful in avoiding reinventing the wheel.

And the more things change the more they stay the same.

Like depending on Libnet v1.0.2a.  They still give you a link to a dead Web site in the docs so you can download this ancient piece of code required to build snort.  Luckily (I think it was luck) freebsd.org still had it in their archives.

Also luckily Mr. Security Thought Leader only wants to send snort alerts to a centralized SIM/SIEM syslog server, which simplifies everything (although he doesn’t know that… he would complicate the fuck out of everything if he did know it).  This is the only documented design requirement in the whole project:

Send snort to syslog!

That’s it!  Nothing more.  What he plans to do after that is a mystery.  Right now I have the Proof of Concept running on a few Windows servers and as usual they’re not producing anything of any interest whatsoever.

The Linux servers are another matter entirely.

I hate to say it, but our *ix admins are the biggest newbz I’ve ever met in my long and glorious IT career.  They need to have a vendor hold their hand whenever they do anything and their collective mantra is the age old refrain:

THE VENDOR WON’T SUPPORT IT!!!

To make matters worse, they are going to have to build snort if their vendor doesn’t distribute a 2.8.6 version of snort.  And considering they run Red Hat, they’re going to have a long wait.

So with all that in mind I built snort 2.8.6.1 for my Linux firewall (good old Debian Etch) and configured it for syslog alerts only.

It’s been running for about an hour now and all I’m getting is:

(http_inspect) LONG HEADER [Priority: 3]

… from just about every Web site I visit.  You would think with all this proxy crap running every hour I’d at least get a “Hey! Somebody’s using an external proxy” kind of alert but no.

There’s obviously some tuning that needs to be done (max http header was 750, so I upped it first to 1024, which wasn’t enough, and then to 2048), but with all the doom & gloom about hackers and cybercrime, et cetera, I really expected a shitload more alerts.

I guess my firewall rules are pretty good after all.

FWIW, it took less than ten hours for some idiot named Tedickhead to remove my PoTTY entry at Wikipedia, without any reason given.  Of course, it pissed me off but I refrained from putting it back in for the time being.