WPAD.dat security risks

[localzuk]

So, I had an IT audit done during the holiday, and one of the points is that the WPAD.dat method of transparent proxying is risky. As far as I can tell, there are a couple of issues that could occur with it, if it weren't set up properly:

 

If someone were to set up their own dhcp server, they could issue a fake wpad file to clients. We have a couple of things in place to protect against this. Firstly, we have port based authentication, meaning unauthorised devices can’t connect to the network, so it’d have to be an authorised device doing it (which are all locked down to prevent software installing). Also, the network is “subnetted” meaning that the core switch tells clients directly which DHCP server to use – which is always our one. It’d take significant technical skill to do this on our network. We could, as another level of protection, implement an intrusion detection server, which monitors network traffic for things such as rogue servers and reports back on them. We don’t have one now, but it could be put in place relatively easily.

 

Our domain is “school.somerset.gov.uk”, if we didn’t have a “wpad.school.somerset.gov.uk” server, a client would escalate to wpad.somerset.gov.uk and then wpad.gov.uk, followed by wpad.uk to search for the server. We do have a wpad.school.somerset.gov.uk server, so escalation should never happen. However, to reduce the risk further, I am going to put in place blocks on the addresses wpad.somerset.gov.uk/wpad.gov.uk/wpad.uk so traffic cannot reach those servers even if it tries.

 

If our ISP had implemented DNS hijacking (like BT do when a site isn’t found), it could break the process. It isn’t an issue for us as we have our own onsite DNS servers, so requests for it would never go outside our network in the first place.

 

Am I right in thinking the above should be plenty to mitigate the issues with security and WPAD.dat proxying?

[sparkeh]

Seems like you have it covered to me:

 

1. The DNS attack method (where an attacker pretends to be a wpad server and picks up clients broadcasting for a wpad server) is covered by having a wpad entry in DNS (which is why every network should have a DNS entry for wpad whether they use it or not).
   
2. The spoof DHCP server attack method is covered by your port authentication, subnetting and locked down devices.