|
WinGate Proxy Server
Reported October 21, 1997 by Bill Mattocks
Systems Affected
Networks Employing the WinGate Proxy
The Problem
The attack was described most adequated by the person reporting it to us, Bill Mattock:
A recent hole has been discovered in the default security settings of a popular Windows 95 / Windows NT proxy server called WinGate, by Deerfield Communications:
This bug was discovered by a 15-year-old hacker, Joshua E. Rodd, whose e-mail address is [email protected]
As a semi-well-known anti-spammer, I am active in the Usenet newsgroup known as news.admin.net-abuse.email. Recently, we anti-spammers came under attack by person or persons unknown, who was sending us a variety of hateful e-mail, seemingly from different dialup ISP ports around the world.
I was fortunate enough to observe two such attacks in progress, and I telnetted to the IP addresses indicated by the headers on the e-mail messages. In each case, I was greeted by a "WinGate>" prompt, although the IP addresses were different.
Apparently, a number of other anti-spammers got the same "hate" e-mail, and notified the ISP that the e-mail appeared to be coming from - in at least one case, a dialup user lost their access because of the complaints.
Because I had seen a "WinGate" prompt at two different IP addresses were the attacks seemed to be originating from, I decided to do a little digging. I discovered that the text of the message contained some mispellings that were unusual. I used DejaNews to search for those mispellings, in conjunction with the word "WinGate." I thereby discovered young Mr. Rodd.
He had discovered this bug, had written an exploit for it, and had written a netscanner which would comb a specified netblock looking for vulnerable WinGate hosts. He managed to find that if one telnets to a WinGate host that is not properly secured (which was, until a week or so ago, the default state of these servers), one could telnet into and then back out of the WinGate server, which would "launder" one"s actual IP address. Thereafter, if one mounted an attack on another machine, or if one sent e-mail by "hijacking" an open SMTP server, one would seem to be coming from the location of the WinGate server. This exploit was used to harass anti-spammers with untraceable e-mail, but one could well imagine that it could be used for a variety of other attacks.
It is easy to see that this type of IP laundering would be simpler to perform than IP spoofing, and nearly as bulletproof in terms of being untraceable.
Joshua has, unfortunately, disseminated his hacking tools far and wide by now, as he was quite proud of his abilities.
This information has been reported by C/Net news last week, and has been given to Deerfield Communications as well. Michael Deerfield is the CEO of the corporation, and he is quite concerned, but he is also understandably quite concerned about the potential publicity damage to his company. He was initially a bit hostile, posting messages in Usenet news to the effect that this type of "wide open" behaviour of his WinGate Proxy server was "by design," and was totally secure. He failed to immediately grasp that although the INTERIOR of the proxy server probably is safe from attack, the rest of the Internet is not safe from this exploit, which would result in fingers of blame being pointed back at his innocent clintele, and then eventually to WinGate.
WinGate has indicated that this "bug," which they still claim is not a bug, has been repaired in the newest version of WinGate, v2.0. However, WinGate is available as shareware, and Deerfield Communications has estimated that there are hundreds of thousands of copies of the older software in circulation. Deerfield HAS placed simple instructions on disabling telnet on their web page, with a quick description of why a sysadmin would want to do so.
This information has been reported to CERT at [email protected], however, they have not responded at this time, and it has been nearly two weeks since I reported it. Vint Cerf has also been notified, and he assigned an MCI security person to look into it, and that person has not responded to me at this time, either (after an initial e-mail message, that is).
As this is not an exploit designed to penetrate a network, nor is it an Denial of Service attack, I believe that many people are pooh-pooh"ing the incident, and I have heard comments to the effect that "all firewalls and proxy servers are like that." Perhaps so, but I only know of this one at this time.
Stopping the Problem:
Load the new version of WinGate 2.0 located here.
Vendor"s Response:
Default configrraton error.
To learn more about new NT security concerns, subscribe to NTSD.
Credit:
|
WinGate Proxy Server
0 comments
Hide comments
