Tag Info

New answers tagged

0

Actually it does not... I am pretty sure it uses php's USERADDR function which gets the IP of the client. So it is either a problem with your proxi you are using or a bland cache issue. Clear your cache and try going here: http://goo.gl/fzrpX8


3

WhatIsMyIP does not need anything javascript-related to get your IP. Almost always your proxy will set the header X-Forwarded-For on your request. WhatIsMyIP will get your primary IP from that. Try accessing this site and see all the headers your browser sent and the headers your proxy added. If you install Firebug on Firefox, you can compare the headers ...


0

I agree with everything that the first person to answer your question has said -- this is likely a router DNS hack, UNLESS there is persistent malware on some other endpoint (say, your child's computer) within your local LAN (the one whose IP addresses start with "192.168" etc. etc.) that is attacking the rest of your local infrastructure faster than you can ...


1

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure. You can reset the DNS server settings to what ...


0

1) Part of the answer depends a lot on the kind of company you work for. I used to work at a Fortune 100 defense contractor, and I can tell you any decent IT system will red flag unknown encrypted data leaving the company network in a heartbeat. They're not looking for someone accessing blocked sites, but that kind of activity can look a lot like a ...


1

TOR also maintains a directory of exit nodes, which is public. So, it's easy to detect that a user is coming in via a TOR proxy by simply checking if their origin IP is listed as a TOR exit node.


2

They can realize you are from a proxy if enough distinct traffic is coming from the end point of the proxy or if it is a published proxy end point. That doesn't mean they can tell who you are, but there are some large caveats. If "they" is a government agency with jurisdictional control over the proxy or the proxy isn't an encrypted VPN proxy or isn't ...


2

Yes, absolutely. This is a classic man-in-the-middle attack. All traffic (encrypted or not) runs through the server before being passed to you. It would be trivial to read (and modify) unencrypted traffic (so anything over HTTP). HTTPS is different. As long as it's not a web based proxy, I think you'll be fine as long as you check the certificate is ...


0

"Proxy server" is an imprecise term. You have to think about what the proxy server is protecting to determine where it fits on the network. For example, web proxy servers used to channel outbound web surfing are often placed on internal networks rather than DMZs - their connections are outbound and they pose no additional "threat" to the internal network - ...


1

You are correct that if the attacker gets onto your proxy, then all systems that trust the proxy are vulnerable in some way. Your proxy is now as valuable a target as the sum of all the traffic flowing to the machines that trust it. What you can do to help limit your exposure is to restrict the intended key usage on your root certificate, limiting its use ...


1

The certificate file by itself does not suppose a threat. When you load it into your browser it only lists it as a trusted source. That means that any certificate signed by that issuer should be trusted and thus allow you to connect to a site. Without access to the corredponding private key (which should be only present in the proxy), it cannot be used to ...


0

Organizations often have a separate internal dmz, where services such as the proxy server is available for the clients inside the organization. This is however not entirely outside the firewall, but in a security zone with the appropriate firewall policy and often ips. There are many reasons for such a design, and the most important one is that servers on ...


0

What you describe is not what is usually called a "proxy". The normal "proxy" is a machine which is close to the client, not the server; communications between the client and the proxy are not normally encrypted (they can be, but that's rare); and when the target server uses HTTPS, then the SSL is between the client and the server, the proxy seeing only the ...



Top 50 recent answers are included