1. Top 5 Most Dangerous Proxies http://www.deepnines.com/ http://www.deepnines.com/proxy-blocker/ 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 1

2. Agenda Understanding Proxies Most Dangerous Proxies Countdown Prevention and Gaps 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 2

3. Understanding Proxies 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 3 Defining and Understanding the Types of Web Proxies Available Today

5. From a network security perspective, web proxies are the unauthorized use of a proxy server for circumventing network security policies, filtering solutions and firewalls

6. Once a user connects to a proxy server, the proxy then connects the user to the unfiltered Internet 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 4

7. Proxies and Filter Avoidance Complete Anonymous Surfing of Websites Circumvents existing network security and content filtering solutions Unfiltered, free rein of the Internet Prevents administrators from monitoring or reporting on users Original Intent Provide uncensored access to the Internet in oppressed nations Still operational for people of many nations Unintended Outcome Easy to build and use Became circumvention tactic for users wanting unfiltered access 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 5

9. Tor clients

10. Anonymizers

11. CGI

12. PHP

13. ROT13

14. Base64

15. RC4

16. Circumventors (HTTP/HTTPS)

17. Transparent (HTTP, Sockv4/5)

19. Host programs (ex: UltraSurf)

20. VPNs

21. Logmein

22. Gotomypc

23. Gotoassist

24. And the list goes on…There are over 23 different types of proxies and filter avoidance techniques

25. 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 7 Most Dangerous Proxies Countdown Top Five Most Dangerous Web Proxies

27. Anonymous proxies are URL-based proxies available through web or IP addresses

28. Characteristics

29. “Cat-and-mouse” game

30. Very prevalent, extremely easy to find and use

31. Thousands of new ones generated daily

32. Not difficult to block once the URL is know but requires constant black listing

33. Examples

34. CGI, PHP, Circumventor, Browser-based, etc.5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 8

35. 1. Email distribution list and spam in the morning 2. Blacklisting all day 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 9

36. #5: Anonymous Proxies, Cont’d… Known by a specific URL, making it easier for traditional filters to block Groups exists that are dedicated to creating new proxies each week These are not detected by filters for 2-3 days Examples Include PHP pinksocks.info CGI adiofairy.com ROT13 and Base64 stupidcensorship.com 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 10

37. Definition Circumventor software can be placed on a home (or any out-of-network) computer and it will return a URL that acts as a proxy and can be used to connect back to that computer for anonymous browsing Characteristics These URLs are dynamic and easily changed if ever discovered and blocked Works well for people who do not know how to set up a web server and have a broadband connection at home Example: http://adsl-68-93405.dsl.rcsntx.swbell.net/peacefire911437will be assigned URL and distributed as www.goldenscar.com 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 11 #5 (b): Circumventors

40. Software or an OS feature allowing graphical applications to run remotely on a server while being displayed locally

41. Characteristics

42. Easy to set up

43. Both free and subscription versions

44. Uses ports that are usually open, or not inspected such as HTTP 80 or HTTPS 443

45. Difficult to determine when it’s being used

46. Example

47. RDP 2 home, Logmein, GotoMeeting, etc.5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 14

48. #4: Remote Desktop Connections 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 15

50. Tunnels form a secure connection between the user and a server on the outside of the network in order to conceal the traffic

51. Characteristics

52. Uses encryption to conceal sessions

53. Can’t be easily (if at all) decrypted for inspection

54. Easy to set up at home

55. Ports are usually open to outside

56. Example

57. Most common tunnels are VPN (Virtual Private Network), SSL, UDP and SSH5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 16

59. Client comes native with Windows and iPhone

60. Hardware / software cost is low

62. Access server easily set up with no Linux experience

63. Hardware / software cost is low

64. Client runs Linux, Win2000/XP/Vista, OpenBSD, FreeBSD, Mac OS X & Solaris

67. Secure proxy sites form an encrypted, secure connection between the user and the site

68. Characteristics

69. Emailed to distribution lists / spammed daily

70. Extremely prevalent

71. Encrypted sessions

72. Ports are usually open for other HTTPS sites

73. Examples

74. HTTPS/SSL5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 19

75. #2: Secure Proxy Sites: SSL Proxies 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 20

77. Host proxy programs run on a user’s desktop and combine multiple circumvention technologies, making them the most dangerous proxies

78. Characteristics

79. Very complex programs

80. Developed and funded by U.S. government

81. Combines multiple technologies

82. Encrypted sessions

83. Undetectable and erratic behavior

84. Finds ports that are open and usable

85. Examples

86. UltraSurf, FreeGate, YourFreedom, etc5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 21

87. Host Programs 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 22

88. 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 23 Prevention and Gaps Flaws in Many Technologies Make Proxies Easy to Explore and Utilize

90. Uses a database of known URLs or Web address

91. Matches are blocked, unknown is allowed

92. 1990’s security methodology

93. Size Matters

94. Google indexes over 1 trillion URLs as of January 2009

95. Largest content filtering databases in the world are <100 million URLs

96. Effectiveness

97. It’s only as good as the last update (best case scenario)

98. Only inspects ports 80 and 8080

99. Only effective as a tool for well-known sites5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 24

100. URL Filters: What Do They See? 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 25

101. URL Filters: What Do People See? 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 26

103. Only allow or block ports and protocols

104. Do not inspect traffic past Layer 3

105. Only cares if stateful connection exists

106. Intrusion Detection/Prevention Systems

107. Concerned mainly about inbound attacks/exploits

108. Does not usually inspect outbound traffic

109. Limited signature set, no focused on content5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 27

111. Decreased productivity

112. Spyware, malware (backdoors, Trojans) and viruses

113. Confidential information leakage

114. Acceptable Use Policy (AUP) violations

115. Copyright lawsuits

116. Most Common Users of Proxies

117. Students (schools)

118. Younger generation of professionals (18 – 30 years old)

119. Disgruntled, frustrated or malicious employees (all ages)5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 28

121. Determine current vulnerabilities, gaps and risk levels

122. Proxy Blocker Technology

123. Utilizes specially architected deep packet inspection intellectual property to identify the fabric of what makes up a proxy in order to prevent or block the connection

124. Signature Updates

125. Content filter (for known sites)

126. Proxy blocker / DPI (for unknown sites)5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 29

127. Questions and Answers 5/13/2010 DeepNines Technologies, Inc. Confidential © 2009 30 Additional questions email: sales@deepnines.com call: 1-866-DEEP9-12 www.deepnines.com