Solved

Stop IIS from being used as a proxy

Posted on 2013-10-25
12
291 Views
Last Modified: 2013-11-18
We have two IIS sites on two different servers that host Exchange OWA and ADFS.  We noticed a lot of traffic from our network and determined that on a remote computer you can put in the IP address and port of those two IIS servers into the computers proxy settings and it works as a proxy to browse any website on the internet.

How can we block this traffic?
0
Comment
Question by:sjohnson_Aerosim
  • 6
  • 4
  • 2
12 Comments
 
LVL 19

Expert Comment

by:strivoli
ID: 39600359
Which port is set on the computers proxy settings?
Is this port bound to IIS?
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600403
Port 80 and yes it is bound to IIS, we tested this by changing the port in IIS to 8080 then the attacker can no longer connect on port 80 but can on 8080.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39600681
Since this seams very strange I must ask again with an example (I must be sure I understood properly). I'm outside your LAN and your IIS responds to the public IP aaa.bbb.ccc.ddd. If I put aaa.bbb.ccc.ddd on my computer's proxy settings I will be able to browse the Internet using your server? If this is it: the public IP I will expose (http://whatismyipaddress.com/), will be yours public IP or mine?
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:sjohnson_Aerosim
ID: 39600706
Your example is correct and the public IP will be mine.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39600723
I'm afraid you are infected. Or even worse your system is a zombie.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600734
Which version of IIS is this? It has to be an old one.

Simon.
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600758
I am going to run virus scans on it now and the version is IIS8.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600820
IIS 8? So we are talking about Windows 2012?

I expect someone has installed everything under IIS in roles and features, rather than just the specific requirements for Exchange.

It may well be best to stop Exchange, remove IIS completely and reinstall it.

Simon.
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39612327
It appears we have narrowed the issue to a problem with our Barracuda Web Filter 410.  They are currently working on the issue.
0
 
LVL 19

Expert Comment

by:strivoli
ID: 39612739
That sounds very strange. You wrote that after changing IIS's port from 80 to 8080 you could use it as a proxy pointing to 8080 instead of 80.
How does the Barracuda act as a proxy (for outside and unauthenticated users) and changes it's behavior as soon as IIS changes it's listening port?
I sincerely hope you have found the origin of the issue but I suspect it isn't the Barracuda.
0
 

Accepted Solution

by:
sjohnson_Aerosim earned 0 total points
ID: 39642104
Barracuda has confirmed that it is a bug with their software.  We are using the Web Filter inline so all traffic is goes through it and for whatever reason it is allowing people to proxy off open ports.  This will be fixed in the next update around Jan 1st, 2014 and in the meantime we made exceptions for the servers affected so it doesn't look at any of the traffic.
0
 

Author Closing Comment

by:sjohnson_Aerosim
ID: 39655994
We tested and confirmed this is the solution.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this increasingly digital world, security hacks are no longer just a threat, but a reality. As we've witnessed with Target's big identity hack 2013, Heartbleed in 2015, and now Cloudbleed, companies and their leaders need to prepare for the unthi…
There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question