Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, called PS for simplicity. Local USB/CDrom drive access has also been disabled.

Can I ask if this is possible:

Because I can still use the internet, I can download tunnelling software (such as stunnel or equivalent), install it (the administrator did not disable software installation) and setup a secure channel to tunnel data back to a server which I have set up elsewhere? One problem is, all internet access has to go through PS. How easy can this done or is it even possible?



You could use any VPN software to do this, for example TunnelBlick. This works in any environment, not just locked down office environments. Indeed, it is used by people under oppressive regimes that restrict normal internet access (to Facebook, Twitter etc.). The people in China and Iran, to name a couple of examples, use this method. However, there has been news that certain VPN services have been blocked by the Chinese Information Ministry, so VPNs aren't totally foolproof. But then again, most companies will not have the same IT resources as a State will have, so they are likely to work in most offices.

  • hi Greenonline, thanks for reply. How does these types of VPN work? is it via some commonly used ports like HTTP? Somehow it's disguised as HTTP traffic ? thanks – dorothy Feb 16 '15 at 0:37
  • That is another question in itself! :-) A quick answer is there are a number of different protocols each with different characteristics and strengths. OpenVPN is generally considered the strongest. Once the tunnel has been created from the client to an external server, all traffic can be routed through that tunnel, not just HTTP, so BitTorrent as well, for example. It works through encryption and/or encapsulation. – Greenonline Feb 16 '15 at 5:50

Set up a a ssh server to listen on port 53(DNS) somewhere, and then use winscp to connect to your server and copy things. Most sysadmins are too afraid to filter DNS ( the protocol), because of unintended consequences ( AD might not work anymore). Here's the proxy options for winscp.. http://winscp.net/eng/docs/ui_login_proxy


I suggest to use VPN gate. Its Japanese Academic Experiment Project which is mainly used for bypass network restrictions like firewalls and proxies.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.