Hinky’s Proxy Obsession

I got bored with snort and intrusion detection a few years ago.

The last thing I did with snort was try to code a netfilter detector/packet killer for one of Luigi’s UT99 hacks.

It was an epic FAIL.

I even read the docs!

But back in the day I ran snort & ACID (now BASE – how clever) on a number of boxes, both at work and at home.  I got very tired of seeing all those false positives, every day, day after day after day.  And then reading in the snort online docs that a particular rule I was unfamiliar with had “no known” false positives or negatives.

Riiiiight.

And then snort went commercial.  Well, good riddance.

So it’s been at least three years since I touched it.

Suddenly, out of nowhere, my boss the Security Thought Leader decides snort has to be deployed throughout our organization on every-fucking-thing that can run it.  And since I was stupid enough at one time to open my mouth and let the word “snort” fall out of it, it’s my problem.

Lo and behold we’re now up to snort v2.8.6.1.  And it turns out to be a bad time to be implementing snort.

As of June 2010 (Hey!  That’s like… now!) a lot of the old freeware utilities for managing snort are obsolete.  Not that they were any good, but their very existence was helpful in avoiding reinventing the wheel.

And the more things change the more they stay the same.

Like depending on Libnet v1.0.2a.  They still give you a link to a dead Web site in the docs so you can download this ancient piece of code required to build snort.  Luckily (I think it was luck) freebsd.org still had it in their archives.

Also luckily Mr. Security Thought Leader only wants to send snort alerts to a centralized SIM/SIEM syslog server, which simplifies everything (although he doesn’t know that… he would complicate the fuck out of everything if he did know it).  This is the only documented design requirement in the whole project:

Send snort to syslog!

That’s it!  Nothing more.  What he plans to do after that is a mystery.  Right now I have the Proof of Concept running on a few Windows servers and as usual they’re not producing anything of any interest whatsoever.

The Linux servers are another matter entirely.

I hate to say it, but our *ix admins are the biggest newbz I’ve ever met in my long and glorious IT career.  They need to have a vendor hold their hand whenever they do anything and their collective mantra is the age old refrain:

THE VENDOR WON’T SUPPORT IT!!!

To make matters worse, they are going to have to build snort if their vendor doesn’t distribute a 2.8.6 version of snort.  And considering they run Red Hat, they’re going to have a long wait.

So with all that in mind I built snort 2.8.6.1 for my Linux firewall (good old Debian Etch) and configured it for syslog alerts only.

It’s been running for about an hour now and all I’m getting is:

(http_inspect) LONG HEADER [Priority: 3]

… from just about every Web site I visit.  You would think with all this proxy crap running every hour I’d at least get a “Hey! Somebody’s using an external proxy” kind of alert but no.

There’s obviously some tuning that needs to be done (max http header was 750, so I upped it first to 1024, which wasn’t enough, and then to 2048), but with all the doom & gloom about hackers and cybercrime, et cetera, I really expected a shitload more alerts.

I guess my firewall rules are pretty good after all.

FWIW, it took less than ten hours for some idiot named Tedickhead to remove my PoTTY entry at Wikipedia, without any reason given.  Of course, it pissed me off but I refrained from putting it back in for the time being.

Although press reports of hacking activity are usually poorly informed, this story out of the UK seems to document what happens when someone turns your system into an open proxy:

A couple from Lincolnshire say they are being plagued by computer hackers.

The pair say they are being put through hell by a hacker who has broken through their security.

Now Donna James, 43, and Rachel Burton’s home router is being used as an internet server for an unknown number of people…

Ms James, who is doing a masters degree in design, said: “They’ve basically ripped our lives apart.

“We don’t use our computers for anything out of the ordinary but who knows what the people using us as a server have been doing.”

Even though the word “proxy” is missing entirely from this article, it’s obvious that’s what they’re talking about. I don’t recall ever seeing a story similar to this (even without the obviously lesbian couple).

The code is getting much better at detecting non-proxies with the Referer hack, but as my code gets better I keep stumbling across crud in other people’s code.

Since twiddling the CoDeeN detection, I have been making small resurrection runs on the “gold” database, pulling 500 “dead” proxies at a time and checking the results. Interestingly, I’m getting somewhere between 1% and 2% worth of good hits, which is very typical of even the crappiest proxy lists found in the wild (with the possible exception of ProxyCemetary, which must be the worst proxy list of all time).

I discovered that two of my proxy judges (so far) don’t bother to return the Http-Referer header, which is fine for Transparent and Anonymous proxies, but sucks ass when it comes to High Anon servers. So, out they go. All of the other judges seem fine.

I’m not sure why you would bother not returning that field, although most of these pages don’t know they’re proxy judges.

Then there’s shit like this. Don’t worry, it won’t bite.

If you Google the IP, it’s in proxy lists everywhere, over 1500 hits worth.

How the Hell does that get into proxy lists? Maybe it is a proxy if you have a login (I haven’t tried brute forcing a login), but it’s useless if you don’t.

Then there’s “This site is running TeamViewer.” This is usually on a variety of ports on the same IP address. Pure crap. There are hundreds of them. Check out this nonsense from their “Security Statement“:

International top corporations from all kinds of industries (including such highly sensitive sectors as banks and other financial institutions) are successfully using TeamViewer.

And their IP addresses are on proxy lists?

DOH!

No big surprise there. 

The junk filter worked flawlessly.  However, I never intended it to take out the CoDeeN proxies.  Some would say that’s no great loss because they are, in fact, junk.  But I’ve grown somewhat fond of them, so they will be back, but not in the main list.

I have been using the SwitchProxy Tool for Firefox for quite some time.  It’s very handy for testing proxies, although it does some silly things now and then (for instance, when you select “None” it clears whatever settings you originally had in the browser), but one of its main features is it lets you use a text-based list of addresses and ports that it will cycle through either sequentially or randomly. 

This is not very useful for testing, but if you have a big list of known good proxies it works very well.  The problem is getting that big list in the first place.  The CoDeeN list works great for this since there are so many of them and they’re all – with some exceptions – “fast enough”.

So, I’m going to split off the CoDeeNs and make them available on the left side menu as a text link.  You can then add this link to  SwitchProxy and browse through multiple CoDeeN servers.

From the SwitchProxy toolbar, select Add->Anonymous->Next and you’ll see the interface.  Just plop in the link, decide how often you want to switch, and you’re ready to rock’n'roll.  I haven’t decided on a name for the link yet, but it will probably be:

http://www.mrhinkydink.com/codeen.txt

Original, no?  Don’t get excited because it’s not there yet.  I have to resurrect them from the database first (since they got junked by the junk filter) and hack the code around.

Stay tuned.

I have finally starting clearing the junk out.  For example, since the beginning there have been about 20-30 Japanese entries in the list that were garbage.  They’re finally gone.

I also learned a lesson about wget that didn’t directly affect the list.  Under certain circumstances, if you get, say, a “403 Access Denied” response, wget will not store the page you would normally see in your browser.  This only affected the “Timeout” servers, but there is more junk to be found if there is a 302 or 304 redirect.

I exported all the non-CoDeeN proxies and used SwitchProxy, a FireFox plug-in, to check the junk factor.  There’s still a fair amount in there, but the next purge should take care of most of it.

It seems that Interesting Sites 1 and 2 are gone for good.  No more 75,000+ proxy imports.  I’m glad I got those when I could.  Curious Site is still supplying proxies, and of course I still hit the other lists every night (but they have nothing).  I’m running the Google Hack on and off but not getting much live data.  I’m going to keep hitting it because that’s where the Interesting Sites came from in the first place.  Somewhere, there’s an IS-3 out there.