Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Stop IIS from being used as a proxy

Posted on 2013-10-25
12
Medium Priority
?
311 Views
Last Modified: 2013-11-18
We have two IIS sites on two different servers that host Exchange OWA and ADFS.  We noticed a lot of traffic from our network and determined that on a remote computer you can put in the IP address and port of those two IIS servers into the computers proxy settings and it works as a proxy to browse any website on the internet.

How can we block this traffic?
0
Comment
Question by:sjohnson_Aerosim
  • 6
  • 4
  • 2
12 Comments
 
LVL 20

Expert Comment

by:strivoli
ID: 39600359
Which port is set on the computers proxy settings?
Is this port bound to IIS?
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600403
Port 80 and yes it is bound to IIS, we tested this by changing the port in IIS to 8080 then the attacker can no longer connect on port 80 but can on 8080.
0
 
LVL 20

Expert Comment

by:strivoli
ID: 39600681
Since this seams very strange I must ask again with an example (I must be sure I understood properly). I'm outside your LAN and your IIS responds to the public IP aaa.bbb.ccc.ddd. If I put aaa.bbb.ccc.ddd on my computer's proxy settings I will be able to browse the Internet using your server? If this is it: the public IP I will expose (http://whatismyipaddress.com/), will be yours public IP or mine?
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:sjohnson_Aerosim
ID: 39600706
Your example is correct and the public IP will be mine.
0
 
LVL 20

Expert Comment

by:strivoli
ID: 39600723
I'm afraid you are infected. Or even worse your system is a zombie.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600734
Which version of IIS is this? It has to be an old one.

Simon.
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39600758
I am going to run virus scans on it now and the version is IIS8.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39600820
IIS 8? So we are talking about Windows 2012?

I expect someone has installed everything under IIS in roles and features, rather than just the specific requirements for Exchange.

It may well be best to stop Exchange, remove IIS completely and reinstall it.

Simon.
0
 

Author Comment

by:sjohnson_Aerosim
ID: 39612327
It appears we have narrowed the issue to a problem with our Barracuda Web Filter 410.  They are currently working on the issue.
0
 
LVL 20

Expert Comment

by:strivoli
ID: 39612739
That sounds very strange. You wrote that after changing IIS's port from 80 to 8080 you could use it as a proxy pointing to 8080 instead of 80.
How does the Barracuda act as a proxy (for outside and unauthenticated users) and changes it's behavior as soon as IIS changes it's listening port?
I sincerely hope you have found the origin of the issue but I suspect it isn't the Barracuda.
0
 

Accepted Solution

by:
sjohnson_Aerosim earned 0 total points
ID: 39642104
Barracuda has confirmed that it is a bug with their software.  We are using the Web Filter inline so all traffic is goes through it and for whatever reason it is allowing people to proxy off open ports.  This will be fixed in the next update around Jan 1st, 2014 and in the meantime we made exceptions for the servers affected so it doesn't look at any of the traffic.
0
 

Author Closing Comment

by:sjohnson_Aerosim
ID: 39655994
We tested and confirmed this is the solution.
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With more and more companies allowing their employees to work remotely, it begs the question: What are some of the security risks involved with remote employees and what actions should we take to secure them?
Exchange database can often fail to mount thereby halting the work of all users connected to it. Finding out why database isn’t mounting is crucial and getting the server back online. Stellar Phoenix Mailbox Exchange Recovery is a champion product t…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question