Proxy paslaugų aktyvumo ypatumai

 in Dokumentai  tagged old by

HTTP proxy

 

Pastaruoju metu pastebėti tokio tipo skenavimai:

 

         12/12-16:13:55.588789 69.57.146.77:2485 -> 193.xxx.xx.161:8080
         12/12-16:20:53.416556 69.57.146.77:3136 -> 193.xxx.xx.177:8080
         12/12-16:55:16.149517 69.57.146.77:2389 -> 193.xxx.xx.1:80
         12/12-16:55:41.540787 69.57.146.77:2775 -> 193.xxx.xx.2:80
         12/12-16:56:34.206923 69.57.146.77:3645 -> 193.xxx.xx.4:80
         12/12-16:57:00.241034 69.57.146.77:4084 -> 193.xxx.xx.5:80
         12/12-16:57:52.424968 69.57.146.77:4929 -> 193.xxx.xx.7:80
         12/12-16:59:11.970261 69.57.146.77:2104 -> 193.xxx.yy.10:80
         12/12-16:59:39.845173 69.57.146.77:2493 -> 193.xxx.xx.11:80
         12/12-17:00:06.673450 69.57.146.77:2883 -> 193.xxx.xx.12:80
         12/12-17:04:50.025261 69.57.146.77:2952 -> 193.xxx.xx.23:80
         12/12-17:05:16.576284 69.57.146.77:3309 -> 193.xxx.xx.24:80
         12/12-17:06:03.070631 69.57.146.77:3961 -> 193.xxx.xx.24:80
         12/12-17:06:08.434649 69.57.146.77:4053 -> 193.xxx.xx.26:80
         12/12-17:06:50.834804 69.57.146.77:4647 -> 193.xxx.xx.24:80
         12/12-17:06:54.241108 69.57.146.77:4681 -> 193.xxx.xx.26:80
         12/12-17:07:42.463328 69.57.146.77:1440 -> 193.xxx.xx.26:80
         12/12-17:08:17.661912 69.57.146.77:1917 -> 193.xxx.zz.31:80
         12/12-17:10:28.893077 69.57.146.77:3681 -> 193.xxx.xx.36:80
         12/12-17:10:55.487352 69.57.146.77:4026 -> 193.xxx.xx.37:80
         12/12-17:15:43.468270 69.57.146.77:3893 -> 193.xxx.xx.48:80
         12/12-17:23:59.960500 69.57.146.77:2495 -> 193.xxx.xx.67:80
         12/12-17:26:36.607833 69.57.146.77:4529 -> 193.xxx.xx.73:80
         12/12-17:36:15.443311 69.57.146.77:3826 -> 193.xxx.zz.95:80
         12/12-17:36:42.292062 69.57.146.77:4136 -> 193.xxx.yy.96:80
         12/12-17:37:08.658278 69.57.146.77:4448 -> 193.xxx.xx.97:80

 

Iš skenavimų turinio matyti, kad yra ieškoma atvirų HTTP proxy paslaugas teikiančių serverių, leidžiančių naudotis SMTP paslaugomis:

 

12/12-16:13:55.588789 69.57.146.77:2485 -> 193.xxx.xx.161:8080
TCP TTL:116 TOS:0x80 ID:23203 IpLen:20 DgmLen:74 DF
***AP*** Seq: 0xC8BCF16B  Ack: 0xF2A563E3  Win: 0x4470  TcpLen: 20
43 4F 4E 4E 45 43 54 20 36 35 2E 35 34 2E 31 36  CONNECT 65.54.16
36 2E 39 39 3A 32 35 20 48 54 54 50 2F 31 2E 30  6.99:25 HTTP/1.0
0D 0A                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/12-16:20:53.416556 69.57.146.77:3136 -> 193.xxx.xx.177:8080
TCP TTL:116 TOS:0x80 ID:29049 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0x94455E03  Ack: 0xF8DB55A1  Win: 0x4470  TcpLen: 20
43 4F 4E 4E 45 43 54 20 36 35 2E 35 34 2E 32 35  CONNECT 65.54.25
33 2E 32 33 30 3A 32 35 20 48 54 54 50 2F 31 2E  3.230:25 HTTP/1.
30 0D 0A                                         0..

....................................

01/04-12:15:47.854793 213.180.193.68:39272 -> 193.xxx.yy.9:80
TCP TTL:55 TOS:0x0 ID:41603 IpLen:20 DgmLen:87 DF
***AP*** Seq: 0xE744DC8A  Ack: 0x8F3E4BFE  Win: 0xE240  TcpLen: 32
TCP Options (3) => NOP NOP TS: 128530780 9511934 
43 4F 4E 4E 45 43 54 20 32 31 33 2E 31 38 30 2E  CONNECT 213.180.
31 39 33 2E 31 3A 32 35 20 48 54 54 50 2F 31 2E  193.1:25 HTTP/1.
30 0D 0A                                         0..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

01/04-12:15:47.855387 213.180.193.68:39290 -> 193.xxx.yy.9:80
TCP TTL:55 TOS:0x0 ID:41606 IpLen:20 DgmLen:133 DF
***AP*** Seq: 0x348A986D  Ack: 0x8F419A80  Win: 0xE240  TcpLen: 32
TCP Options (3) => NOP NOP TS: 128530780 9511934 
50 4F 53 54 20 68 74 74 70 3A 2F 2F 32 31 33 2E  POST http://213.
31 38 30 2E 31 39 33 2E 31 3A 32 35 2F 20 48 54  180.193.1:25/ HT
54 50 2F 31 2E 30 0D 0A 43 6F 6E 74 65 6E 74 2D  TP/1.0..Content-
6C 65 6E 67 74 68 3A 20 32 30 0D 0A 43 6F 6E 6E  length: 20..Conn
65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A 0D  ection: close...
0A                                               .

 

Tinkamai sukonfigūruotas serveris atsisako aptarnauti tokias užklausas:

 

01/04-12:15:47.855270 193.xxx.yy.9:8081 -> 213.180.193.68:39281
TCP TTL:64 TOS:0x0 ID:6361 IpLen:20 DgmLen:103
***AP*** Seq: 0x8F406F83  Ack: 0x911AB218  Win: 0xFFFF  TcpLen: 32
TCP Options (3) => NOP NOP TS: 9511934 128530780 
48 54 54 50 2F 31 2E 30 20 34 30 35 20 49 6E 76  HTTP/1.0 405 Inv
61 6C 69 64 20 6D 65 74 68 6F 64 0D 0A 0D 0A 4D  alid method....M
65 74 68 6F 64 20 6E 6F 74 20 61 6C 6C 6F 77 65  ethod not allowe
64 0D 0A                                         d..

 

Skenuotojui radus atvirą proxy serverį, matyti atsakas:

 

0.000001 66.90.79.58 -> 193.xxx.yy.71 HTTP CONNECT 64.12.137.184:25 HTTP/1.0
0.012746 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [SYN] Seq=0 Ack=0 Win=8192 Len=0 MSS=1460
0.025746 64.12.137.184 -> 193.xxx.yy.71 TCP smtp > 2787 [SYN, ACK] Seq=0 Ack=1 Win=33580 Len=0 MSS=1460
0.000596 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [ACK] Seq=1 Ack=1 Win=8760 Len=0
0.011017 193.xxx.yy.71 -> 66.90.79.58  TCP 14977 > 34734 [ACK] Seq=1 Ack=38 Win=8723 Len=0
0.004975 193.xxx.yy.71 -> 66.90.79.58  HTTP HTTP/1.0 200 Connection established

 

Vėliau toks atviras proxy serveris panaudojamas SPAM laiškams platinti:

 

 0.003607 64.12.137.184 -> 193.xxx.yy.71 SMTP Response: 220-rly-xj02.mx.aol.com ESMTP mail_relay_in-xj2.7; 
Tue, 23 Dec 2003 09:46:55 -0500
 0.013464 66.90.79.58 -> 193.xxx.yy.71 TCP 34734 > 14977 [ACK] Seq=38 Ack=40 Win=5840 Len=0
 0.001325 193.xxx.yy.71 -> 66.90.79.58 HTTP Continuation
 0.000109 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [ACK] Seq=1 Ack=480 Win=8281 Len=0
 0.034057 66.90.79.58 -> 193.xxx.yy.71 TCP 34734 > 14977 [ACK] Seq=38 Ack=519 Win=6432 Len=0
 0.027058 66.90.79.58 -> 193.xxx.yy.71 HTTP Continuation
 0.004439 193.xxx.yy.71 -> 64.12.137.184 SMTP Command: HELO ynfkgic
 0.002405 64.12.137.184 -> 193.xxx.yy.71 TCP smtp > 2787 [ACK] Seq=480 Ack=15 Win=33580 Len=0
 0.000595 64.12.137.184 -> 193.xxx.yy.71 SMTP Response: 250 rly-xj02.mx.aol.com OK
 0.017680 193.xxx.yy.71 -> 66.90.79.58 HTTP Continuation
 0.000125 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [ACK] Seq=15 Ack=508 Win=8253 Len=0
 0.008059 66.90.79.58 -> 193.xxx.yy.71 TCP 34734 > 14977 [ACK] Seq=52 Ack=547 Win=6432 Len=0
 0.000129 66.90.79.58 -> 193.xxx.yy.71 HTTP Continuation
 0.009045 193.xxx.yy.71 -> 64.12.137.184 SMTP Command: MAIL FROM: <Blondellsfhtx@emaila.nu>
 0.008507 64.12.137.184 -> 193.xxx.yy.71 SMTP Response: 250 OK
 0.000238 193.xxx.yy.71 -> 66.90.79.58 TCP 14977 > 34734 [ACK] Seq=547 Ack=90 Win=8671 Len=0
 0.012049 193.xxx.yy.71 -> 66.90.79.58 HTTP Continuation
 0.027886 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [ACK] Seq=53 Ack=516 Win=8245 Len=0
 0.000121 66.90.79.58 -> 193.xxx.yy.71 HTTP Continuation
 0.000348 193.xxx.yy.71 -> 64.12.137.184 SMTP Command: RCPT TO: <Handz@aol.com>
 0.014606 64.12.137.184 -> 193.xxx.yy.71 SMTP Response: 250 OK
 0.000942 193.xxx.yy.71 -> 66.90.79.58 HTTP Continuation
 0.000115 193.xxx.yy.71 -> 64.12.137.184 TCP 2787 > smtp [ACK] Seq=79 Ack=524 Win=8237 Len=0
 0.049303 66.90.79.58 -> 193.xxx.yy.71 HTTP Continuation
 0.015652 193.xxx.yy.71 -> 64.12.137.184 SMTP Command: DATA
 0.023100 64.12.137.184 -> 193.xxx.yy.71 SMTP Response: 354 START MAIL INPUT, END WITH "." ON A LINE BY ITSELF

 

Atradęs tokią darbo stotį, SPAM platintojas gali išsiųsti šimtus tūkstančių SPAM laiškų (priklausomai nuo to, kaip greitai bus aptiktas, koks ryšio greitis ir pan.). Tai gali sukelti tokius šalutinius poveikius:

 

    • Apkrauti darbo stotį/serverį

 

    • Perpildyti tinklo resursus

 

    • Darbo stotis/serveris gali būti įtrauktas į juodus sąrašus, dėl kurių gali kilti sunkumų siunčiant elektroninius laiškus ar atliekant kitas komunikacijas.

 

Todėl yra svarbu laiku aptikti tokius bandymus (sėkmingus ar nepasisekusius) piktavališkai panaudoti jūsų tinklo resursus. Tam sėkmingai galima panaudoti IDS sistemas tinkamai jas sukonfirgūravus. Snort konfigūracijos šablonas:

 

alert TCP any any -> any any          (msg: "SMTP bandymas per HTTP proxy"; content: "CONNECT          "; offset:0; depth:40; content: ":25 HTTP/1.0"; distance:          7; within: 27; nocase; classtype: relay-attempt; tag: host, 5, packets,          dst;)

 

SOCKS proxy

 

Kitos panašios atakos naudoja SOCKS protokolą (RFC1928 – 5-ta SOCKS versija). Šiuo atveju į pažeidžiamą SOCKS serverį siunčiamos prisijungimo komandos. Pagal RFC1928:

 

Versija Komanda Reserved ATYPE  

DST.ADDR

 

  

DST.PORT

 
05 01 00 01  

41 36 FD E6

 

  

00 19

 

čia

    • Versija – SOCKS protokolo versija;

 

    • Komanda 01 == connect

 

    • ATYPE: Address type, 01==IPv4

 

    • DST.ADDR: 0x4136FDE6 == 65.54.253.230

 

    • DST.PORT: 0x0019 == 25 (smtp)

 

SOCKS serveriui atlikus skming susijungim, iniciatoriui grinamas patvirtinimas:

 

Versija Atsakymas Reserved ATYPE  

BND.ADDR

 

  

BND.PORT

 
05 00 00 01  

C1 DB xx xx

 

  

0D FC

 

Čia

    • Versija – SOCKS protokolo versija;

 

    • Atsakymas 00 == sėkmingas prisijungimas

 

    • ATYPE: Address type, 01==IPv4

 

    • BND.ADDR: 0xC1DBxxxx ==193.219.xx.xx

 

    • BND.PORT: 0x0DFC == (3580)

 

    • Toks atsakymas reiškia, kad buvo sėkmingai susijungta 193.219.xx.xx:3580 -> 65.54.253.230:25

 

Tokių prisijungimų išklotinė:

 

12/23-10:56:31.429700 66.98.216.62:2326 -> 193.xxx.zz.150:1080
******S* Seq: 0x8334F2EA  Ack: 0x0  Win: 0x4000  TcpLen: 28
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.429933 193.xxx.zz.150:1080 -> 66.98.216.62:2326
***A**S* Seq: 0x7B66EB16  Ack: 0x8334F2EB  Win: 0xFFFF  TcpLen: 28
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.584023 66.98.216.62:2326 -> 193.xxx.zz.150:1080
***A**** Seq: 0x8334F2EB  Ack: 0x7B66EB17  Win: 0x4470  TcpLen: 20

 

 Sinchronizacija su SOCKS
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.584151 66.98.216.62:2326 -> 193.xxx.zz.150:1080
***AP*** Seq: 0x8334F2EB  Ack: 0x7B66EB17  Win: 0x4470  TcpLen: 20
05 01 00                                         ...

 

 Autentifikacijos metodas == be autentifikacijos
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.585100 193.xxx.zz.150:1080 -> 66.98.216.62:2326
***AP*** Seq: 0x7B66EB17  Ack: 0x8334F2EE  Win: 0xFFFC  TcpLen: 20
05 00                                            ..

 

 Patvirtintas autentifikacijos metodas
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.739663 66.98.216.62:2326 -> 193.xxx.zz.150:1080
***AP*** Seq: 0x8334F2EE  Ack: 0x7B66EB19  Win: 0x446E  TcpLen: 20
05 01 00 01 41 36 FD E6 00 19                    ....A6....

 

 Jungtis prie 65.54.253.230:25
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.740871 193.xxx.zz.150:3580 -> 65.54.253.230:25
******S* Seq: 0x7B6BF17A  Ack: 0x0  Win: 0xFFFF  TcpLen: 28

 

 Sinchronizacija su 65.54.253.230:25
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.867551 193.xxx.zz.150:1080 -> 66.98.216.62:2326
***A**** Seq: 0x7B66EB19  Ack: 0x8334F2F8  Win: 0xFFF2  TcpLen: 20

 
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.942850 65.54.253.230:25 -> 193.xxx.zz.150:3580
***A**S* Seq: 0x8C0EABE1  Ack: 0x7B6BF17B  Win: 0x4470  TcpLen: 28
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.942974 193.xxx.zz.150:3580 -> 65.54.253.230:25
***A**** Seq: 0x7B6BF17B Ack: 0x8C0EABE2 Win: 0xFFFF TcpLen: 20

 

 Sinchronizacija su 65.54.253.230:25
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:31.943095 193.xxx.zz.150:1080 -> 66.98.216.62:2326
***AP*** Seq: 0x7B66EB19  Ack: 0x8334F2F8  Win: 0xFFF2  TcpLen: 20
05 00 00 01 C1 DB 44 96 0D FC                    ......D...

 

 sėkmingai susijungta 193.xxx.zz.150:3580 -> 65.54.253.230:25
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:32.157981 65.54.253.230:25 -> 193.xxx.zz.150:3580
***AP*** Seq: 0x8C0EABE2  Ack: 0x7B6BF17B  Win: 0x4470  TcpLen: 20
32 32 30 20 6D 63 38 2D 66 31 38 2E 68 6F 74 6D  220 mc8-f18.hotm
61 69 6C 2E 63 6F 6D 20 4D 69 63 72 6F 73 6F 66  ail.com Microsof
74 20 45 53 4D 54 50 20 4D 41 49 4C 20 53 65 72  t ESMTP MAIL Ser
76 69 63 65 2C 20 56 65 72 73 69 6F 6E 3A 20 35  vice, Version: 5
2E 30 2E 32 31 39 35 2E 36 37 31 33 20 72 65 61  .0.2195.6713 rea
64 79 20 61 74 20 20 54 75 65 2C 20 32 33 20 44  dy at  Tue, 23 D
65 63 20 32 30 30 33 20 30 30 3A 35 36 3A 33 32  ec 2003 00:56:32
20 2D 30 38 30 30 20 0D 0A                        -0800 ..

 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:32.268174 193.xxx.zz.150:3580 -> 65.54.253.230:25
***A**** Seq: 0x7B6BF17B  Ack: 0x8C0EAC5B  Win: 0xFF86  TcpLen: 20

 

 SMTP serverio pasisveikinimas / SOCKS proxy server/
 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:32.291118 66.98.216.62:2326 -> 193.xxx.zz.150:1080
***A**** Seq: 0x8334F2F8  Ack: 0x7B66EB23  Win: 0x4464  TcpLen: 20

 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/23-10:56:32.291124 193.xxx.zz.150:1080 -> 66.98.216.62:2326
***AP*** Seq: 0x7B66EB23  Ack: 0x8334F2F8  Win: 0xFFF2  TcpLen: 20
32 32 30 20 6D 63 38 2D 66 31 38 2E 68 6F 74 6D  220 mc8-f18.hotm
61 69 6C 2E 63 6F 6D 20 4D 69 63 72 6F 73 6F 66  ail.com Microsof
74 20 45 53 4D 54 50 20 4D 41 49 4C 20 53 65 72  t ESMTP MAIL Ser
76 69 63 65 2C 20 56 65 72 73 69 6F 6E 3A 20 35  vice, Version: 5
2E 30 2E 32 31 39 35 2E 36 37 31 33 20 72 65 61  .0.2195.6713 rea
64 79 20 61 74 20 20 54 75 65 2C 20 32 33 20 44  dy at  Tue, 23 D
65 63 20 32 30 30 33 20 30 30 3A 35 36 3A 33 32  ec 2003 00:56:32
20 2D 30 38 30 30 20 0D 0A                        -0800 ..

 

 SMTP serverio pasisveikinimas SOCKS proxy serverio susijungimo iniciatoriui

Tokius sėkmingus prisijungimus galima užfiksuoti tokia snort taisykle:

 

alert TCP any any -> any any (msg: "SOCKS sekmingas prisijungimas prie LITNET hosto"; 
                              content:        "|05 00 00 01 c1 db|"; 
                              depth: 6; offset: 0;)

 

Ši taisyklė pritaikyta fiksuoti SOCKS proxy serverio atsakymus apie sėkmingus prisijungimus. C1DB==193.219, t.y. savo tinklo numeris.

 

Kiti naudojami SPAM platinimo būdai

 

Aukščiau paminėti būdai buvo dažniausiai pastebimi 2003 metais. Be čia paminėtų proxy paslaugų SPAM laiškams platinti gali būti naudojami ir kiti būdai:

 

    • SOCKS4 protokolas

 

    • HTTP POST

 

    • HTTP PUT

 

    • SMTP relay

 

Tinkamai juos ištyrus galima sudaryti panašias IDS taisykles tokius prisijungimus fiksuoti (ir nutraukti)