0

We have a network that currently has zero internet access. I want to provide a means for the users on the network to access certain productive sites for reference, such as the Stack Exchange Network, W3Schools, Perl Monk, etc. Also I want them to be able to download the latest updates for their applications, including Firefox, Chrome OS, IntelliJ, perhaps even Windows updates.

This is on a whitelist basis only. This way if one of them ends up with a virus, it would not have a way to call home, because 'home' is not on the whitelist. (I don't expect anyone with access to Perl Monk servers to be collecting sensitive files submitted by a virus. It would have to be some other arbitrary IP address.)

However, I then realized, that data could be posted in the form of an Email or Forum Question, without the whitelisted network's intentional cooperation.

One option is to adjust the proxy to only allow GET requests. For example, Stack Exchange can be navigated readily with only GET requests, but content cannot be submit without the use of a POST request. In this way the developers could still get answers to their questions without giving viruses a way to call home.

  1. Is a whitelist of hosts reasonable?
    (I'm thinking yes, since it makes 'call home' more difficult for a virus.)

  2. Is permitting GET only, without POST considered impractical, or is this a technique used in the industry. Am I crazy or is this a good idea to set on the Transparent Proxy?

Sites should restrict any data submission functionality to POST requests, to protect themselves against CSRF. So following the assumption that the participation will be good in the whitelisted sites, it seems like allowing GET requests is a good idea. What is recommended?

2

I don't think your average virus is designed to circumvent whitelist blocks, and doing so via a forum question seems too low bandwidth to be worrisome (or interesting for the average virus writer).

I say 'average', because this kind of behaviour is more to be expected of a tailored virus designed to exfiltrate very selected information from your network.

But, at that point (i.e. a virus designed just for your systems), I wonder whether it wouldn't be possible to setup some sort of covert channel - haven0t tested it, but maybe reading a question via GET increments its view counter? In that case the virus and its CCC server could agree beforehand on a number of very old questions, that are unlikely to get views, and the combination in which to view them in order to encode a given sequence of bits.

I think that for the "average" scenario you're doing way too much (but, hey, better safe than sorry - belt and suspenders and all that). For the "they're looking for you" scenario, isolated (and expendable, maybe just through imaging and reformatting) workstations and physical compartmentalization of Stack Overflow queries and sensitive information seem preferable.

  • Right, implementing my #1 above circumvents the average virus. The targeted virus is a different story entirely, and that is what prompted me to ask this question. You are probably right that I should physically separate the Stack Exchange queries (VM perhaps), and just make a private copy-paste transfer interface instead. However I appreciate you exploring this GET-only idea first. – Bryan Field Jul 8 '16 at 23:06
1

Is a whitelist of hosts reasonable? (I'm thinking yes, since it makes 'call home' more difficult for a virus.)

Whitelisting hosts is definitely reasonable when it comes to blocking the malicious network communication. However, the site visits for all whitelisted endpoints requires communication with other third-party entities. The combined ecosystem is what makes the overall experience pleasant. So you can go about whitelisting things but it will become harder to maintain as the list expands.

Is permitting GET only, without POST considered impractical, or is this a technique used in the industry. Am I crazy or is this a good idea to set on the Transparent Proxy?

It is impractical. With every endpoint you add, you will have to understand the protocols and tantrums expected of it. I am pretty sure a large group of whitelisted sites do not support GET only approach.

  • Fortunately the sites we are interested in seem to support GET only. For example, I ran a Google search, and there was only a single POST request, which is for a non-critical Google+ feature. Visiting Stack Exchange does not require POST requests either. I'm sure that I will later find sites that break without POST requests, and even the ones that work now are subject to change. – Bryan Field Jul 8 '16 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.