Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need some help to identify possible (and rational) threats that could apply to that part of IT infrastructure (WebProxy).

I have a webproxy for my users, which behave like a classic webproxy and i'm ok with that (url filtering, flux analysis, etc.).

I recently noticed that destination port (like port 80, or 81, or any other port) was accessible throught that proxy (for example, my browser is configured to reach first my proxy on port 8080 for example, then i can reach http://www.example.com:33944 if www.example.com is listening on port 33944).

What could be the threat to let users / computer reach and URL through a non-standard port ? (including tunneling)

share|improve this question
add comment

1 Answer

What could be the threat to let users / computer reach and URL through a non-standard port ?

If the proxy allows https access, then that means potentially, anyone on the inside can connect anywhere on the outside regardless of port or protocol - from the proxies point of view, it just sees a CONNECT request which opens a stream level proxy to the specified end point.

How bad could it be? You tell me - what's the worst thing that would happen if you allowed machines inside your network to connect to anything on the internet (which, in effect you may already be doing).

share|improve this answer
    
That was one of the threats i was thinking of. That said, if someone on the inside wants to create a "gateway" to the outside through tunneling, he can always do it on port 443, with an ssh deamon server he controls outside, listening on port tcp/443 right ? So i'd be tempted to say that there's no new "threats" that could apply that were not present with a proxy forwarding connexions on port 443 (mostly all of existing proxies?). Please correct me if i'm wrong. –  Anon Nov 28 '11 at 14:43
    
The proxy can enforce the protocol to be HTTP or an SSL setup. That will greatly mitigate "shenanigans" that could come from allowing non-standard ports. Your proxy could then still be used as an SSL tunneling hop, but somebody would have to bother configuring a tunnel that spoke SSL first. –  Jeff Ferland Nov 28 '11 at 16:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.