Proxy bypass details in cookies

[Guest theeldergeek]

We are having a bit of an 'issue' with proxy bypass abuse in the college at present, and are looking at ways of dealing with this.

 

In the short term, we search cookies for words like "Bebo" which in turn uncover those sites which are being used for access.

 

I have noticed that these sites 'plant' the destination site usernames within cookies, and have proved this out by picking a username out of a cookie, and doing a search for said username on Bebo.

 

Is it possible that these proxy by-pass sites also plant passwords in cookies, albeit encrypted or hashed in some way?

 

Is it possible to reveal these passwords?

 

We are trying a tactic of 'scaring' students to demonstrate that their details are held within cookies and such like, and that these proxy bypass sites are not secure and could easily be 'hijacking' students details for more malicious use. If we could uncover a few passwords within these cookies, we would really have some ammo, and it would be a big bonus to demonstrate to students how unsafe their actions potentially are.

 

Does anyone know a way of revealing passwords in cookie files, if indeed they are stored within such?

 

We are of course looking at longer term solutions such as teacher control of computers in classrooms, however, a short term 'shock and awe' tactic would be most welcome!

 

TIA

[PEO]

can you identify the areas its been done? college library, IT classes?

[Joanne]

ethereal was one that could decrypt passwords... but i think that was from traffic if found there and then. It also took some setting up... but once it was set up you could get allsorts of info from it.

[Domino]

I think the guy who originally developed ethereal has moved on to wiresharek now - might be worth a look

[Guest theeldergeek]

can you identify the areas its been done? college library, IT classes?

 

No, in the main we are looking at cookies written to their profile when they log off, i.e. those held on the server.

 

We would be able to look at the local machine on many occasions though as teachers would be able to highlight which machine a user was logged into.

[Jona]

It would be very bad website practice to store a password in a cookie. I will probably only be storing a session ID, even if it was to store a password it would probably be md5'ed (or similar) which is impossible to decrypt except comparing like strings. I think you need to find one of these cookies and do more in-depth analysis.

 

 

Ethereal can't decrypt passwords but if setup right it would be able to sniff them going over the network in some circumstances, although possible not if it's an SSL connection as that would basically be a man-in-the-middle attack

[Guest theeldergeek]

It would be very bad website practice to store a password in a cookie. I will probably only be storing a session ID, even if it was to store a password it would probably be md5'ed (or similar) which is impossible to decrypt except comparing like strings. I think you need to find one of these cookies and do more in-depth analysis.

 

 

Ethereal can't decrypt passwords but if setup right it would be able to sniff them going over the network in some circumstances, although possible not if it's an SSL connection as that would basically be a man-in-the-middle attack

 

Hmmm, not good..... I know nothing of sniffing, so would be interested in developing this further, although, we obviously don't want to spend huge resources (in respect of time) getting this going - there are other, more appropriate methods out there I'm sure - we were looking for a short 'shock' tactic to get the students to understand the potential consequences of their actions.

 

In so far as it being bad practice, methinks the purveyors of these proxy by-pass sites don't actually have any morals, so with a bit of luck, their bad practice will be a tool which we can use to counter-attack the intended usage.

[Joanne]

you could block the proxy bypass websites?

 

we blocked a load... plus the words *proxy* and *proxy bypass* and *proxybypass*

 

I could send you a csv file of them all if you wanted

[Gerry]

Our policy is to immediately ban the internet for any student caught using a proxy bypass for a fortnight. They also get a disciplinary letter explaining that they've breached the acceptable use policy they or their parents/guardian signed when they applied for an IT account. We also try to ban as many proxy bypass sites as possible, but new ones keep popping up all the time.

[Guest theeldergeek]

you could block the proxy bypass websites?

 

we blocked a load... plus the words *proxy* and *proxy bypass* and *proxybypass*

 

I could send you a csv file of them all if you wanted

 

 

Oh, we've blocked 100's of sites, and block several more each week. We also use web filtering as you suggest to block the searching of sites, but as you are probably aware, this is but a small solution to a huge problem and cetainly isn't the answer.

 

What we ultimately will have, is teacher control software, however, for the time being, we want something that will make the kids sit up and pay attention, i.e. revealing to them their Bebo login details!

[Guest theeldergeek]

Our policy is to immediately ban the internet for any student caught using a proxy bypass for a fortnight. They also get a disciplinary letter explaining that they've breached the acceptable use policy they or their parents/guardian signed when they applied for an IT account. We also try to ban as many proxy bypass sites as possible, but new ones keep popping up all the time.

 

Our policy is also to ban them, however, this is having little or no impact, as they then go and use another students account, or just don't care.

 

We are now discussing a total Internet ban for good.... that is, they will be unable to use the Internet unsupervised, full stop.

 

Ultimately, we are going to have our system set up so the Internet is blocked by default and it is only when a teacher allows it in a classroom via control software that it will be available.

 

It has got to such a stage now that these social networking sites have become an addiction to many - not that I ever got addicted to the Internet myself of course....

 

Difficult to preach what so many of us probably don't practice! I mean, how many unrelated to work websites have us lot been on today!

 

Nonetheless, I still want to catch the little sods!

[enjay]

It would be very bad website practice to store a password in a cookie.

 

True, but remember that lots of proxy bypass sites are (allegedly) run for the purpose of gathering exactly that information for use in fraud, scams, etc. Sites doing such things wouldn't be storing the information in cookies though, instead logging it centrally on their own server somewhere.

 

@tx2online - I like where you're going with this, but wonder if you're perhaps over-thinking it slightly. Since the default privacy setting on MySpace is to have your profile public, you can probably see the profile pages for lots of the students, so you could possibly achieve much the same effect by looking at a few profiles and then asking a kid "so, how was the party at John's house at 8pm on Saturday night then? I hear you made out with Sarah..." or whatever.

[Theblacksheep]

We ban all proxies, we dont allow searching for proxies and we get an email warning from our server when anyone is searching for them. We VNC and warn anyone doing so to get off straight away.

 

We also watch what sites arent categorised and add them to the lists as we go.

 

The most effective thing i've found are keywords that prevent searching i the first place. Alot of students have given up and used their mobile phones.

[Guest Guest]

Just use a content filter then you dont need to "scare" kids as they wont be getting on any baughty sites eitherway

[Guest theeldergeek]

 

@tx2online - I like where you're going with this, but wonder if you're perhaps over-thinking it slightly. Since the default privacy setting on MySpace is to have your profile public, you can probably see the profile pages for lots of the students, so you could possibly achieve much the same effect by looking at a few profiles and then asking a kid "so, how was the party at John's house at 8pm on Saturday night then? I hear you made out with Sarah..." or whatever.

 

erm... but if that's publicly possible anyway, we won't be able to shock them into realising we can effectively 'hack' their details when they are using our network.

 

One also might imagine the reputation you'd get amongst the students if you went through their 'social' profiles - they'd think you were a bit 'strange' shall we say, and it might attract some unwanted interest in your own social activities.

 

No, if we can 'hit' them from a technical angle to say "look, what you are doing is not only wrong, but potentially dangerous - see I have your account details" then they might think twice about accessing proxy by-pass sites.

 

Given these sites are so 'infectious' amongst youngsters, and given they are so protective over things like MSN and Bebo accounts, then to demonstrate an ability to reveal the account details to them would maybe keep them from accessing such via alternative means? Who knows?

 

However, when all is said and done, it seems it is not the easiest of things to do (for obvious reasons!) and although potentially achievable using 'sniffers', might require considerable time to set up and then diagnose.

 

I was hoping to view a cookies content, and using some 3rd party util, reveal encrypted passwords left behind by the site, but it's looking most unlikely that I can.

 

[tom_newton]

Would agree with Jona - passwords need never be stored in cookies, and its unlikely you'll find much, as the "decision" is made at facebook/bebo etc., the proxies merely proxy cookies in the same way they do HTML.

 

None of the common proxy tools I have... dismantled.. come with password pinching as standard. The usual way to make money is from adwords (though its against google's ToS to do this except on the front page...).

 

Of course I am going to advocate use of real content filtering to block proxies, as "scare tactics" only go so far. Would still employ the old "bogeymans gunna get you" line though, as its certainly inadvisable to use a proxy in *any* scenario, and, for example, to be caught using one in a commercial/work environment is much more serious, so it is arguably a good education!

[Guest theeldergeek]

We ban all proxies, we dont allow searching for proxies and we get an email warning from our server when anyone is searching for them. We VNC and warn anyone doing so to get off straight away.

 

We also watch what sites arent categorised and add them to the lists as we go.

 

The most effective thing i've found are keywords that prevent searching i the first place. Alot of students have given up and used their mobile phones.

 

OK, let me make it clear - we too DO NOT allow proxies, nor the searching of, and we too have banned many, many sites.

 

We also have prevented keyword searching.

 

However, youngsters being youngsters, they will find ways to circumnavigate any defence you put in place.

 

There is nothing to stop them utilising their own home connections to make a list, scribble it down, and bring it to school. So long as it hasn't already been blocked, or doesn't contain keywords, then it is wide open.

 

We found one the other day 'jeremyfones.com' or similar - who would think a site called that offered a proxy!?!?

[Guest theeldergeek]

Just use a content filter then you dont need to "scare" kids as they wont be getting on any baughty sites eitherway

 

And this works for you? Perhaps you can explain how you implement a content filter, and how you would ensure this worked when students access sites thru a proxy by-pass?

 

The idea to "scare" them however, is a two pronged approach.

 

Firstly, it will stifle their desire to access proxy by-pass sites if they think the ICT Teks can then see their account details.

 

Secondly, it will maybe educate them for the future.

 

I don't hold out any hope for the latter, the former would mean an awful lot less work for us in the long run and probably work far better than any 'education' on the matter!

 

Anyway, over to you concerning the content filter....

[enjay]

erm... but if that's publicly possible anyway, we won't be able to shock them into realising we can effectively 'hack' their details when they are using our network.

 

True, but it will hopefully shock them into realising just how much information about themselves they put out there for all the world to see, which is arguably a more important lesson than making them realise that a proxy by-pass site might harvest their MySpace details.

[zag]

I just signed up to the mailing list of new proxies on my webmail account. It send through a list every now and then new ones which we block.

 

Seems to work for us. No idea why smartfilter cant do this as a company though, they seem very slow at blocking this particular type of site.

[Guest Guest]

And this works for you? Perhaps you can explain how you implement a content filter, and how you would ensure this worked when students access sites thru a proxy by-pass?

 

Yes it works. It isnt like a black-list/white-list one, it actually looks at the content of the page not just the URL. Without going into detail it just looks for key words and passes judgment on the site based on the naughty words, but also looks at common phrases wi=hcih include naughty words but in a non-naughty context ie The Naked Chef, Blue Tits

 

Have a word with Tom_Newton. He works for a company called Smoothwall. Obviously he is going to sell his product but listen to him, the product works and afaik i havnt seen him telling porkies on this forum.

 

Heres what his product is built on, if you know your stuff on linux you could build your own. Or you could use a free proxy and mod it with Dansguardian - Smoothwall Community is an example.

DansGuardian - True Web Content Filtering for All

Edited April 2, 2008 by Guest

[Guest theeldergeek]

True, but it will hopefully shock them into realising just how much information about themselves they put out there for all the world to see, which is arguably a more important lesson than making them realise that a proxy by-pass site might harvest their MySpace details.

 

In all honesty I'm more concerned with them accessing a proxy by-pass site in school, on my time, when i then have to spend time sorting it out when I already have a workload that could easily employ another tech.

 

Whilst we all perhaps have a moral/social responsibility in respect of online safety, that is for another conversation at another time. Even if I did convince the kids to not reveal all that they do on these sites, and they followed my advice, would it stop them accessing such? Would they suddenly stop accessing anything via proxy by-pass? I doubt it...

 

No, my concern is stopping the proxy by-pass in the first place - I want a method that will make them think twice about doing so, and the 'shock and awe' method of them realising that their account details might be exposed in a cookie because they access these sites using a by-pass seemed a good solution - unfortunately, it doesn't seem cookies that these sites generate contain enough info to do that.

 

Blocking sites, banning searches on keywords, and locking user accounts is going to be a long slog i fear.

[SYNACK]

I had a thought, the main objection is that it could be wrong legally to snoop on the data using the privileges that are given to us by our jobs. A fairly good way around this would be to start your own proxy site and carefully disseminate the information so that the students did not know that it was the school itself.

 

They are then choosing to use your service that can grab details that they provide. just put an eula on the thing in really tiny writing that it may be monitored for quality control or something and you should be sorted.

 

Let it run for a couple of weeks then call the offending students up at assembly to receive their own passwords on a bit of paper. Shock, Awe and shame the trifecta of learning. (just kidding discression would probably be advised)

 

 

I'm sure that there it some open source software out there that would let you set up a proxy like that.

 

Edit: Oops, this should be in your other thread.

Edited April 2, 2008 by SYNACK
mistake