4

At work we are all using Windows 7+, with full administrative privileges. Each PC has a dedicated IP and a proxy is used. It is set as a HTTP proxy and the option to use this for all types of connections is checked.

I have at home a "ddwrt" router with a SSH server. I use PuTTY to establish a SSH connection to my home router using port 443. PuTTY is configured for socks5 proxy tunnelling, and Firefox is enabled to send DNS requests over SSH, and Chrome also (I checked dnsleaktest, and my home configured google public DNS is used, not the company one, no DNS leaks here). I had to set company proxy in Putty to have access to Internet.

Everything is working fine, and I think I'm safe on this, but the proxy I had to set in Putty bothers me a little, as I'm not sure if that proxy can see the traffic that comes from Putty? Or the connection is still encrypted, no matter if that goes over the company proxy, the socks5 tunnel is established through the company proxy.

I guess they see the IP address putty connects to (over port 443, not 22), but that is all, they do not see anything else, just the encrypted stream between my router and PC at work.

I doubt they use any special proxy to incorporate Man in the Middle attack, it would be out of their knowledge, and guess the software would be too pricey for them.

What do you think?

Please spare me of answers that I should not use work for personal stuff, and etc., I do this with the knowledge of my boss, who is sick of the IT stuff and she basically instructed me to make access to social sites.

  • I'm not sure what your question is? – schroeder Jul 22 '15 at 15:59
  • 1
    Unless your boss is at the C-level (or equivalent in your company) over IT Security, how does having their permission make a difference? – Iszi Jul 22 '15 at 18:17
  • I assure you that I know way much in networking then 99% of the IT stuff at our company. That is the sad truth. There is actually one man who might be able to see the connection at 443, and to distinguish it from SSH. I was also interested how does this work at places where really good IT stuff is employed. From the answers I received I guess most likely they would spot the non-regular 443 traffic and block/raise an alert. – kukori Jun 14 '16 at 11:05
3

An investigation should easily conclude that a computer on their network, assigned to you, is connecting to a consumer-grade ISP host on port 443 using SSH and not HTTPS (content inspection can easily determine what protocol you're using, including the ability to detect SSH traffic).

The exact content of this traffic should be opaque (but even this is not guaranteed) without something malicious or some very advanced analysis.

There are a few ways more information can be gleaned:

  • Accidental data leakage (the other answers here address that)
  • A Man-in-the-Middle attack – Make sure you've got the SSH fingerprint right
  • Software/hardware on your computer or work area to intercept your local unencrypted data
  • Requesting (or intercepting) your home ISP's unencrypted side of your tunnel
  • A side-channel attack or advanced frequency analysis.

An example of frequency analysis: there are certain patterns to video and audio; I've even heard of reports suggesting encrypted live audio can be deciphered based on the volume of data (pauses compress well, words not as well, and it's all real-time).

Given just the bursts of data, it should be obvious that you're not just using a shell. I'm guessing it wouldn't be hard to determine that you're browsing the web, though I don't know if this is easily discovered with existing tools.

Given certain attributes of certain websites (e.g. the way sites dynamically load new content requires a certain polling frequency and may pull a certain narrow range of data), it may even be possible to note the sites you're visiting, though I'd doubt that frequency analysis could determine the exact content (a side-channel attack stands a decent chance at this).

If you're worried about a side-channel attack or sophisticated malware or hardware (e.g. a camera behind your chair), getting fired is likely the least of your concerns :-)  We've got at least a few years before that kind of tech becomes ubiquitous enough to be deployed to keep employees on target. Employers looking to be that draconian will go for the cheap option and simply block SSH traffic to unapproved hosts (regardless of the port).

  • Thank you for all of the answers. All are great, it was hard to decide which one to choose, I went with Adam's as it was the most detailed answer. But actually all 3 answers should be considered as correct! – kukori Jun 14 '16 at 10:58
4

As for the DNS: normally, the principle of the SOCKS protocol is that when a client wants to connect to server example.com on port 80, it sends through the tunnel the message "please open a connection to port 80 of example.com and forward the bytes back and forth", so the name example.com will be resolved on the other end of the tunnel (here, your home router). As @M'vy indicates, Firefox can do otherwise, in which case one has to assume that the SOCKS message will talk about the resolved IP address.

As for the corporate proxy, it works as it would work for SSL: the browser sends a "CONNECT" order to the proxy, with a target name and port, and asks the proxy to propagate bytes in both directions. In your case, the corporate proxy believes that it is forwarding some SSL connection, but in fact this is some SSH. The proxy is still "on the outside" cryptographically speaking; it won't see the data, and, in particular, it won't even know which sites you are browsing. The corporate proxy sees one quite busy connection, between your desktop system and your home router.

Note, though, that SSH and SSL protocols do not use the same kind of headers, so the corporate proxy may notice that what goes through it is not SSL (even though it uses the traditional HTTPS port 443) but really SSH. Depending on the surveillance tools and the sysadmin efforts, the proxy may decide that things are fishy and raise an alert.

3

The connection between you and your proxy is encrypted. It goes through the corporate proxy, which can only see encrypted traffic.

As you said, the proxy will register a connection to your proxy IP address and can eventually monitor the quantity of data going through that connection (it is a common way to detect proxy).

It is possible that DNS requests are not going by your proxy, it seems that Chrome browser does it by default, but not Firefox for which you have to toggle the value of network.proxy.socks_remote_dns to True in the about:config.

Concerning a Man In the Middle attack, you have to make sure that the host key provided at login matches the fingerprint of your own server. As a reminder, PuTTY stores the known fingerprint into the registry at : HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys and the server SSHd fingerprint can be checked by running :

for file in /etc/ssh/*sa_key.pub                                                                                
do
    ssh-keygen -lf $file
done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.