Solved

Stop IIS from being used as a proxy

Posted on 2013-10-25
12
288 Views
Last Modified: 2013-11-18
We have two IIS sites on two different servers that host Exchange OWA and ADFS.  We noticed a lot of traffic from our network and determined that on a remote computer you can put in the IP address and port of those two IIS servers into the computers proxy settings and it works as a proxy to browse any website on the internet.

How can we block this traffic?
0
Comment
Question by:sjohnson_Aerosim
  • 6
  • 4
  • 2
12 Comments
 
LVL 19

Expert Comment

by:strivoli
ID: 39600359
Which port is set on the computers proxy settings?
Is this port bound to IIS?
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600403
Port 80 and yes it is bound to IIS, we tested this by changing the port in IIS to 8080 then the attacker can no longer connect on port 80 but can on 8080.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39600681
Since this seams very strange I must ask again with an example (I must be sure I understood properly). I'm outside your LAN and your IIS responds to the public IP aaa.bbb.ccc.ddd. If I put aaa.bbb.ccc.ddd on my computer's proxy settings I will be able to browse the Internet using your server? If this is it: the public IP I will expose (http://whatismyipaddress.com/), will be yours public IP or mine?
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600706
Your example is correct and the public IP will be mine.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39600723
I'm afraid you are infected. Or even worse your system is a zombie.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600734
Which version of IIS is this? It has to be an old one.

Simon.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 

Author Comment

by:sjohnson_Aerosim
ID: 39600758
I am going to run virus scans on it now and the version is IIS8.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600820
IIS 8? So we are talking about Windows 2012?

I expect someone has installed everything under IIS in roles and features, rather than just the specific requirements for Exchange.

It may well be best to stop Exchange, remove IIS completely and reinstall it.

Simon.
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39612327
It appears we have narrowed the issue to a problem with our Barracuda Web Filter 410.  They are currently working on the issue.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39612739
That sounds very strange. You wrote that after changing IIS's port from 80 to 8080 you could use it as a proxy pointing to 8080 instead of 80.
How does the Barracuda act as a proxy (for outside and unauthenticated users) and changes it's behavior as soon as IIS changes it's listening port?
I sincerely hope you have found the origin of the issue but I suspect it isn't the Barracuda.
0
 

Accepted Solution

by:
sjohnson_Aerosim earned 0 total points
ID: 39642104
Barracuda has confirmed that it is a bug with their software.  We are using the Web Filter inline so all traffic is goes through it and for whatever reason it is allowing people to proxy off open ports.  This will be fixed in the next update around Jan 1st, 2014 and in the meantime we made exceptions for the servers affected so it doesn't look at any of the traffic.
0
 

Author Closing Comment

by:sjohnson_Aerosim
ID: 39655994
We tested and confirmed this is the solution.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
how to add IIS SMTP to handle application/Scanner relays into office 365.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now