2

This question at Workplace and its top-voted answers state that using proxies to access filtered web content is extremely risky for individuals and companies, using pretty strong wording.

There are many proxies out there that are honey pots. Access one, and they travel back through your computer into your company's network, then hit it with ransomware

I can hardly see how reading web content through an open proxy subjects the user to these risks. I am assuming that the user takes some precautions, including

  • not installing third-party programs for proxy access
  • not installing third-party browser extensions for proxy access
  • not entering his credentials or otherwise sensitive information in a proxy session
  • having updated software to prevent non-zero-day browser exploits

What risks are connected with using a web proxy that are not mitigated by usual web surfing precautions?

  • Well, it's a post on Workplace.SE, not on Sec.SE, and I can understand why they emphasize that bypassing company security policies needs to be taken seriously. But from a technical point of view, it depends a lot on what exactly you're doing. Downloading executables over plain HTTP through a proxy is reckless. Reading xkcd is probably fine unless you're not encrypting and the proxy injects, say, an 0-day JS exploit. But Access one, and they travel back through your computer into your company's network, then hit it with ransomware sounds more dangerous than the incident probably actually was. – Arminius Feb 21 '18 at 1:16
1

Simple - any content passing through the proxy can be Man-in-the-middled. This could include injecting malicious JavaScript that results in code execution within the browser with a zero day or spectre exploit.

ISP example of content injection

Use TLS and do not install any certificate required by the proxy - but all HTTP traffic will be at risk.

If this is a concern you would need to run the browser that connects to the proxy in isolation. A throw away VM with no network connection and hope there isnt an exploit used to connect back out to the host from guest.

  • This answers the question as to what a malicious proxy can do, but not why proxies themselves are often more dangerous. In my experience, many proxies were created for the sake of injecting ads and other nasty things, to the point where many proxies even set their agent to things like mitmproxy (a tool for interactive MITMing of HTTP connections). – forest Feb 21 '18 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.