• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
Craig Hays

Craig Hays

  • Cybersecurity
  • Principles
  • Newsletter
  • Learn Cyber Security
    • Hacking and Defending User Accounts
    • Learning Guides
  • Contact
  • Show Search
Hide Search
You are here: Home / Archives for Cybersecurity

Cybersecurity

Why You Should Never Trust a Free Proxy Server

November 6, 2020 By Craig Hays Leave a Comment

Reading Time: 6 minutes

Free and open proxy servers promise anonymous internet access, but at what cost?

Never trust an open proxy server
Photo by Mikael Seegen on Unsplash

In a world of ever-decreasing online privacy, it’s easy to get sucked into the ‘use an anonymous proxy to stay safe’ narrative. I’ve got nothing against using reputable proxy services or VPNs (virtual private networks), but the ‘free’ proxy services you find on the web can be anything but.

What’s the Difference Between a Proxy and a VPN?

People use proxies and VPNs (Virtual Private Networks) to hide their real IP address and masquerade as other devices on the internet. There are many reasons to do this including bypassing content geo-restrictions, bypassing government filters (Great Firewall of China), bypassing censorship enforced by your Internet Service Provider (ISP), and hiding your real identity from others online.

Your standard internet connection gives you direct access to everything on the internet. Web pages, Skype and Zoom calls, online gaming, it all goes straight from your device to the final destination. To everyone else on the internet, you are you. Your access is limited to what your ISP and government will let you see. All of your traffic is from the country in which you reside.

A virtual private network (VPN) wraps all of your online activity in an encrypted envelope and sends it to another server, your VPN server. This server then unwraps it and sends it to where you wanted it to go. To everyone else on the internet, you are the VPN server, not the real you. Depending on the location of your VPN server, you will be able to bypass some or all of the restrictions described earlier.

A web proxy receives requests for web pages from your device and fetches those pages on your behalf. All other communication remains direct from your device to the destination servers and back. To all web servers on the internet, you are the proxy server. To everything else, you are you. This has a similar effect to a VPN but only for web browsing.

VPN vs web proxy
Standard access vs. VPN access vs. web proxy access

In summary, a VPN moves your visible internet connection from your device to a remote server. A proxy server fetches web content on your behalf but you still appear as your device to anything non-web related.

Free vs. Paid Proxies and VPNs

When you pay for a VPN or web proxy you can expect a minimum level of service in exchange for your money. That minimum level covers things like:

  • High-availability of access
  • Good transfer speeds
  • Untampered data transfers
  • No logs stored anywhere of what you do (optional for anonymous VPNs/Proxies)

They make money because you pay them. Therefore, they are incentivised to give a good service to keep you coming back for more.

Free VPNs and proxies, on the other hand, don’t make money directly from you. Sure, some of these services offer a ‘free tier’ where they give you a few GB of transfer for free each month. They make a profit when you upgrade to the paid version. These are freemium services with limited trials that entice you to upgrade and pay. When I talk about free proxies and VPNs I don’t mean limited-use free trials.

A ‘free’ service is one that never asks you for money, ever. When you look at these services, you must ask yourself, “why do these exist?” People generally don’t run free VPNs and open proxies for the good of humanity. When you consume these services they’re likely to be using you in some way.

As the saying goes, “if you’re not the customer, you’re the product.”

Finding ‘Free’ Open Web Proxies

A quick search on google for ‘open web proxies’ or ‘anonymous web proxies’ returns thousands of results with links to websites listing proxy servers that anyone can use without paying a penny.

Open proxy server list from a Google search

The above is a screenshot of one of these lists. Each list contains lots of server IP addresses and ports. Anyone can configure their web browser to use any of these free, open proxies to proxy all of their web traffic to the internet. None of these servers come with any guarantees and there’s no indication of who is operating them. Many of them are in countries with very lax cybersecurity laws.

Proxy directories maintain their lists by brute-force scanning the internet for open proxies and accepting user submissions by random members of the public. There is no quality control, no peer review capability, and no oversight in any way. This means people like me can set up our own malicious ‘anonymous’ proxy servers and, within a few minutes, have strangers on the internet sending us all sorts of things.

So what can we do to the users of open proxies?

Data Loss Through an Open Proxy

If you use a proxy server for browsing the web, anything you send or receive that isn’t encrypted, (anything in plain text), can be read by the owner of the proxy service. When your communications are encrypted, the attacker can spoof messages from the target server and force you to downgrade your encryption to a crackable level. When this happens, the server can crack the encryption and read your messages without you ever knowing about it. You or your company IT team can configure your devices to prevent this, but how many actually do it?

Failing that, any content you download that isn’t encrypted can be altered to change all links to secure HTTPS sites to the insecure, plain-text HTTP version. You may not even notice that your browser is no longer asking for encrypted versions of sites as it usually would.

This probably isn’t something you need to worry about with a legitimate service, but that ransom, open proxy server you found on the internet?…

Data Tempering and Content Injection by the Proxy

When data is unencrypted (plain-text), malicious proxies can do more than read what you’re talking about. They can actively contribute to the conversation.

Imagine what would happen if you received a quote for a service and the proxy server you were browsing through changed the bank details of the intended recipient to their own? What if they blocked your content altogether? What if they corrupted it so that it couldn’t be trusted? All of these things are possible when you’re using an untrusted machine-in-the-middle of your comms.

Something else which is possible is ad-fraud. The proxy owner changes any advertising content requests sent by your browser for their own ads. The subtlety of this may vary and you may not even notice it happening. When it does, the legitimate owner of a site loses the revenue you would have generated for them. For many site owners, advertising revenue is what keeps them online.

One of the scariest things I’ve seen with open proxies is the injection of malicious javascript code into the existing javascript of every web page downloaded. Nothing else was changed, it just loaded a small piece of code into your browser every time you opened a new page. This code can access your cookies, make requests on your behalf, and even join a botnet directly from your browser.

Hanging Around With a Bad Crowd

Something not often discussed with open proxies is the behaviour of other users. While you might not be committing any crimes via an open proxy, that doesn’t stop others from doing it beside you. If someone commits a crime and the ‘anonymous’ proxy server is confiscated and reveals its not-so-deleted logs, your IP address and traffic history is going to be right there with the criminals. For pretty much every scenario I can think of, I wouldn’t want my name and address linked with that activity.

Summary

Open proxies may look like a good deal, but most of the time, they’re not. If you’re not paying for them you’re most likely to be the product being sold. Stick with paid and legitimate services to stay safe. The prices are relatively low and the ‘free’ versions could cost you more in other ways.

Inside a Real SMS Phishing Attack (Smishing)

February 5, 2020 By Craig Hays 4 Comments

Reading Time: 8 minutes

SMS based phishing attacks (Smishing) are a real threat that we see every day. To help you spot them in future, this is how they work.

The start of an SMS Phish (Smish)

A Phishing/Smishing Attack In Action

At 17:52 pm today I received a text message from my mobile phone network, ‘EE’. I picked up the message at 18:08. This is what it said:

[Read more…] about Inside a Real SMS Phishing Attack (Smishing)

Cracking Active Directory passwords (Password audit part 2)

May 29, 2019 By Craig Hays Leave a Comment

Reading Time: 4 minutes

John the Ripper loves cracking Active Directory password hashes and your users love ‘Password1!’

(This is the second of a three-part series on Microsoft Active Directory password quality auditing and password cracking)

Following on from part 1 where we used DS-Internals to do some basic password quality auditing, in this post, we extract all of your password hashes from Active Directory and crack them with John the Ripper.

Cracking passwords with DS-Internals

In the previous post, we covered using DS-Internals to do a password quality audit. We did this by using the PowerShell module to examine account configurations for vulnerabilities and we provided a plain text password dictionary for brute forcing our users’ passwords. While the audit for configuration insecurities is excellent, the literal dictionary of passwords to use for cracking is not the most efficient way to do it. Nor is the output of sufficient quality to be as useful as it could be. This isn’t a criticism of the tool, it just isn’t what the tool specialises in.

When you provide a list of thousands of passwords, including globally well-known passwords and company-specific ones such as ‘Company1’ or ‘C0mp4ny123!’, DS-Internals will only tell you is a user password is found in that dictionary. It won’t suggest other similar formats such as ‘Company11111111’ which could also be in use. This is great for identifying users who need to change their passwords to something more secure, provided that you managed to create a comprehensive wordlist on your own. Which most of us probably can’t.

A better way to crack Active Directory passwords

DS-Internals is designed to let us overcome this challenge. Built in is an extensive hash export utility that will provide a range of hash table formats. My personal favourite cracking tool is John the Ripper and output support is built right in.

To export all user hashes from AD use the following:

[Read more…] about Cracking Active Directory passwords (Password audit part 2)

Brute force attack your own users (Password audit part 1)

May 29, 2019 By Craig Hays Leave a Comment

Reading Time: 6 minutes

The bad guys are already doing it. Here’s why and how you should do it too.

(This is the first of a three-part series on Microsoft Active Directory password quality auditing and password cracking)

If your company has anything exposed to the internet, attackers are already brute force attacking your user’s passwords. All day, every day. There are very few things you can do to stop them. Our best hope is to slow them down as they circumvent every countermeasure we put in place and ensure that users have passwords strong enough to withstand a low volume brute force attack.

[Read more…] about Brute force attack your own users (Password audit part 1)

Bug Bounty Hunting Tips #3 — Kicking S3 Buckets

February 22, 2018 By Craig Hays Leave a Comment

Reading Time: 4 minutes

There has been a lot of press recently about misconfigured Amazon S3 buckets leaking confidential information. The root cause of this is that in the past S3 buckets have been incredibly easy to misconfigure. Sometimes buckets are made web accessible by anyone. Other times buckets are web restricted but can be accessed through Amazon S3 API by any authorised user.

Due to the nature and number of these breaches, Amazon have recently released their Trusted Advisor service for S3 for free to everyone to try to crack down on the problem. The challenge now is getting people to look at the new output and make changes based on the feedback. In the meantime, let’s have some fun kicking over S3 buckets to see what bounties fall out.

Finding S3 Buckets

S3 buckets are all reachable via a web interface, whether access is permitted or not. The URL format is:

[Read more…] about Bug Bounty Hunting Tips #3 — Kicking S3 Buckets
  • Go to page 1
  • Go to page 2
  • Go to Next Page »

Primary Sidebar

Newsletter

Want to get smarter about cyber security? Join my growing list of newsletter readers for exclusive news, reviews, how-tos, and more.

· © Craig Hays, 2006–2023 ·

  • Phishing