3

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be able to detect that a proxy is being used by the tablet. Any ideas as to how I could go about doing it?

  • All outgoing traffic goes via VPN? If not how can you detect which path does traffic on different computer is using? – jirib Oct 30 '13 at 12:59
  • If you are trying to put a stop to something then I would suggest strict firewall ACLs. If you don't want a user to do something then limit their ability to do so. – k to the z Oct 30 '13 at 14:32
  • Do you have administrative access to the users device? What about to the SSH server? It could be possible to restrict access with those, but only if they are managed by you. – David Houde Jan 25 '14 at 7:41
3

A VPN is just routing with protection. In your case, the "proxy" ensures that traffic goes first from the tablet to some server S, from which it then goes to "the Internet", e.g. to the entry point for the company's VPN. The "proxy" uses SSH but that's just between the tablet and server S; you cannot see it from the company.

What you will see, though, from the company, is the IP address of S. A relatively invasive strategy is to use OS fingerprinting on that machine (basically, scanning who is connecting) to try to guess whether S is indeed an Android system, or some other kind of OS. If you detect that "who connects" does not use Android directly, then you have shown that some intermediate system, a "proxy", is in use.

(Whether scanning machines who connect is legal is a complex subject which depends a lot on jurisdictions. Don't deploy that without taking some legal counsel.)

Now, of course, in all generality, there is no such thing as a "proxy / no proxy" dichotomy. A basic tablet user will connect over WiFi when he can, connecting to an access point which will use NAT, and that qualifies as a kind of "proxy". This already prevents the reverse-scanning explained above from really working (i.e. most of the time, the scan will see the access point, not the tablet itself).

The whole point of using a VPN like Cisco AnyConnect is to make the proxy question irrelevant: the VPN uses cryptographic protection exactly so that the paths used by data packets have no impact whatsoever on security. You should not have to ask yourself whether some SSH or NAT or whatever is in place. Thus, your question is kind of weird.

| improve this answer | |
  • 1
    I should've provided a few more details. I've got a system that allows/denies access based on where the user is connecting to the VPN from. With the current method defined above, I can use my android tablet in "bad" location, but not be denied access because it looks like I'm coming from the SSH Server, which is in a "good" location. Thus, in order to ensure the integrity of the location detection, I need to make sure that a proxy is not being used. – suss23 Oct 30 '13 at 15:16
  • @suss23 I agree with the last statement from Tom. If you are trying to block based on their location, but they are (effectively) using a VPN to protect themselves and connect to a "good" location, then why is there a problem? This sounds like a win to me. I think your question effectively boils down to "Can I detect if a user is using a proxy" in which case the answer is "maybe". There should be lots here about proxy detection though, which is pretty much what Tom was addressing. – Conor Mancone Jul 18 '18 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.