Re: OT: Geekness - avoiding proxies

In article <heqq025p8ul4itktsl9tf7aun643isepi1@xxxxxxx>, SimonM wrote:
On Tue, 7 Mar 2006 09:35:02 +0000, Phil Launchbury
<phill@xxxxxxxxxxxxxxxxx> wrote:


And as BGN says - be careful. As an ex-network admin I would spot your
traffic pretty easily - and would want to know what and why your PC was
trying to talk to the outside world on an odd port. It is also
conceivable that your external access is by default all blocked with
your firewall admins just opening the desired ports (http etc) and that
your PC exhibiting virus-like network behaviour will trigger all sorts
of alarms..

Sorry, I don't agree with this. You wouldn't easily spot this traffic

*Sigh*

I assume that you have spent five years of your life looking after
firewalls then. You obviously know better than me how they work, how
they are administered and how a good network/security admin does their
job.

Silly me.

and it wouldn't look to be virus-like network behaviour either. It all
depends what is allowed through the firewall. Obviously, for this to

No really? Seeing as we started off on the basis that the IT department
were using a proxy to restrict access to sites its not a huge jump to
imagine that they might restict other outgoing traffic..

work at all you have to be talking to the outside world on a
destination port that is allowed through the enterprise firewalls in
the first place. i.e. deemed acceptable traffic.

Most places allow filtered http to the outside world and nothing else
(except maybe ftp access from IT PCs). Any place that allows any trffic
out that the PC cares to generate are a) terminally stupid and b)
liable to end up with their PC's stuffed with trojans, viruses and
other malware.


If you are suggesting that the employer would be monitoring source
port as well as destination, then that too will be difficult to

You don't really know how firewalls work do you? Hint - it's very easy.
Also look up the concept of application proxies and how they block
tunnelled traffic.

Everyone and their dog used ssh tunneling to get around outbound
firewall port blocking rules and network proxies. Suddenly, for some
reason, destination port 22 was blocked (I never quite figured out why
:-) ). However, for some bizarre reason they still allowed outbound
telnet traffic. Most people and their dogs then configured their ssh
servers to listen on port 23 and tunneled through that instead.

Which indicates to me that your network admins are terminally stupid.
Allowing telnet traffic out while blocking ssh is shooting yourself in
the foot with both barralls and then reloading and doing it again.
Most places start with the basis of "nothing allowed out" and then open
up specific ports. To do otherwise invites disaster.

admins to pick up on it. Realistically that is just not going to
happen in the larger enterprises.

Actually it is there that it is most likely to be spotted.

Phil

--
Phil Launchbury, IT PHB
Triumph Tiger 955i
'I'm training the bats that live in my cube
to juggle mushrooms'
.

Relevant Pages

  • Re: transfer data (securely) between clients via RPC,SSL,...?
    ... a firewall port. ... but you have to choose a port number. ... RPC ... TCP/IP (but in general admin have to open ports firewall manually) ...
    (microsoft.public.win32.programmer.networks)
  • RE: Raptor firewall 6.1 port 80
    ... The Raptor firewall, by default, runs several standard ... state to a scanner (these can be disabled by the admin but usually aren't). ... The SEF (Raptor) has two common ways of administration. ... Both can connect remotely via port 418 and both are encrypted. ...
    (Pen-Test)
  • Re: keeping ports open
    ... If a port is open, it means that 1) a software or service is running on your ... and 2) you're not using a firewall or your firewall isn't ... Use firewall software and hardware and antivirus software that is ... Follow the instructions for hardening Windows and IIS at ...
    (microsoft.public.security)
  • Re: How to Maintain an IIS Server?
    ... > server running on a Windows 2000 server. ... before a firewall and antivirus have been installed]. ... open ports; however, this will not identify which program is using the port. ...
    (microsoft.public.inetserver.iis.security)
  • Re: CEICW fails at firewall config
    ... ISA Server prevents connection to a remote desktop when you connect through ... Remote Web Workplace on a Windows Small Business Server 2003-based computer ... Acceleration Server as a firewall. ... connection uses TCP port 4125. ...
    (microsoft.public.windows.server.sbs)