Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm seeing some odd behaviour on my proxy server logs since I started blocking direct outbound connections to port 443 (thus forcing applications to use the proxy server for HTTPS connections).

I'm seeing lots of low-traffic (in the range of 0 to 20K bytes), long lived (in the range of 1 to 25 minutes) outgoing connections via the proxy server to port 443 on IP addresses in dynamically allocated (consumer ISP) ranges.

The logs show that these connections are being made to the IP, not to a host name that resolves to the IP (so an example would be "CONNECT 1.2.3.4:443" and not "CONNECT dynamic.example.com:443" in the Squid log).

Most of my users have Skype (it is a business tool for them), so I was wondering if this pattern of connections is Skype or something else that I am not aware of.

share|improve this question

1 Answer 1

If you have admin access to the users' systems you can start by dumping the list of open sockets and connected processes with "netstat -nab" on Windows or "netstat -nap" on Linux. Just look for the source and destinations you are seeing in the proxy. That may make it clear what is connecting. You can also try connecting to the server side to collect its certificate. The openssl s_client command is good for this.

openssl s_client -connect IPADDRESS:443 | openssl x509 -text

Hopefully it will be instantly clear if they are benign (Skype or other semi-legitimate traffic) or malicious (command and control channel) connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.