Re: [squid-users] Squid Proxy Vulnerability.

check your config (http_access allow all) ...

change it to
http_access deny all

On Nov 29, 2007 4:21 PM, Josh Fritts <reikoshea@gmail.com> wrote:
> Hello,
>
> We got a notification from our ISP that our squid server was being
> used to relay emails.
>
> We checked the logs and found 2.5 Million hits just like this snippit:
>
> ----------------------------------------------------------------------------
>
> 1196170398.384 837 64.237.46.55 TCP_MISS/200 222 CONNECT
> 146.217.15.240:25 - DIRECT/146.217.15.240 -
> 1196170398.656 8175 64.237.46.132 TCP_MISS/200 665 CONNECT
> 216.157.254.253:25 - DIRECT/216.157.254.253 -
> 1196170399.049 1132 64.237.46.55 TCP_MISS/200 165 CONNECT
> 209.44.115.50:25 - DIRECT/209.44.115.50 -
> 1196170399.201 4603 64.237.46.55 TCP_MISS/200 139 CONNECT
> 62.148.180.192:25 - DIRECT/62.148.180.192 -
> 1196170399.458 14482 64.237.46.132 TCP_MISS/200 224 CONNECT
> 65.75.75.57:25 - DIRECT/65.75.75.57 -
> 1196170400.072 10406 64.237.46.132 TCP_MISS/200 279 CONNECT
> 127.0.0.1:25 - DIRECT/127.0.0.1 -
> 1196170400.460 2044 208.167.225.68 TCP_MISS/200 444 CONNECT
> 192.75.254.1:25 - DIRECT/192.75.254.1 -
> 1196170400.486 9305 64.237.46.132 TCP_MISS/200 1343 CONNECT
> 211.41.82.89:25 - DIRECT/211.41.82.89 -
> 1196170400.662 6576 208.167.225.68 TCP_MISS/200 257 CONNECT
> 64.18.4.10:25 - DIRECT/64.18.4.10 -
> 1196170401.406 17183 64.237.46.132 TCP_MISS/200 2130 CONNECT
> 195.50.106.135:25 - DIRECT/195.50.106.135 -
> 1196170401.503 645 208.167.225.68 TCP_MISS/200 180 CONNECT
> 216.32.180.22:25 - DIRECT/216.32.180.22 -
> 1196170401.682 939 208.167.225.68 TCP_MISS/200 306 CONNECT
> 216.9.208.251:25 - DIRECT/216.9.208.251 -
> 1196170401.747 10433 64.237.46.132 TCP_MISS/200 279 CONNECT
> 127.0.0.1:25 - DIRECT/127.0.0.1 -
> 1196170401.775 10413 64.237.46.132 TCP_MISS/200 279 CONNECT
> 127.0.0.1:25 - DIRECT/127.0.0.1 -
> 1196170402.079 120 208.167.225.68 TCP_MISS/200 15 CONNECT
> 17.148.20.66:25 - DIRECT/17.148.20.66 -
> 1196170402.267 5056 208.167.225.68 TCP_MISS/200 245 CONNECT
> 202.54.61.113:25 - DIRECT/202.54.61.113 -
> 1196170403.291 31145 64.237.46.132 TCP_MISS/200 121 CONNECT
> 62.40.36.103:25 - DIRECT/62.40.36.103 -
> 1196170403.578 5218 208.167.225.68 TCP_MISS/200 273 CONNECT
> 66.235.248.64:25 - DIRECT/66.235.248.64 -
> 1196170403.707 810 208.167.225.68 TCP_MISS/200 452 CONNECT
> 207.69.189.219:25 - DIRECT/207.69.189.219 -
> 1196170404.115 1850 64.237.46.55 TCP_MISS/200 121 CONNECT
> 202.78.116.253:25 - DIRECT/202.78.116.253 -
> 1196170404.166 1502 208.167.225.68 TCP_MISS/200 250 CONNECT
> 193.134.210.132:25 - DIRECT/193.134.210.132 -
> 1196170404.208 4983 208.167.225.68 TCP_MISS/200 2060 CONNECT
> 209.191.118.103:25 - DIRECT/209.191.118.103 -
> 1196170404.249 30567 208.167.225.68 TCP_MISS/200 0 CONNECT
> 64.29.222.22:25 - DIRECT/64.29.222.22 -
> 1196170404.887 7863 64.237.46.55 TCP_MISS/200 2223 CONNECT
> 209.191.88.247:25 - DIRECT/209.191.88.247 -
> 1196170404.916 627 208.167.225.68 TCP_MISS/200 150 CONNECT
> 208.97.132.73:25 - DIRECT/208.97.132.73 -
> 1196170405.288 14668 64.237.46.132 TCP_MISS/200 3520 CONNECT
> 211.115.216.226:25 - DIRECT/211.115.216.226 -
> 1196170405.324 1670 64.237.46.52 TCP_MISS/200 249 CONNECT
> 146.131.119.26:25 - DIRECT/146.131.119.26 -
> 1196170405.659 882 64.237.46.55 TCP_MISS/200 159 CONNECT
> 199.224.89.185:25 - DIRECT/199.224.89.185 -
> 1196170405.917 1555 64.237.46.55 TCP_MISS/200 201 CONNECT
> 204.10.18.136:25 - DIRECT/204.10.18.136 -
> 1196170406.776 30671 64.237.46.55 TCP_MISS/200 0 CONNECT
> 193.252.22.142:25 - DIRECT/193.252.22.142 -
> 1196170407.099 6405 208.167.225.68 TCP_MISS/200 339 CONNECT
> 216.219.253.216:25 - DIRECT/216.219.253.216 -
> 1196170407.214 30834 64.237.46.132 TCP_MISS/200 164 CONNECT
> 12.206.33.39:25 - DIRECT/12.206.33.39 -
> 1196170407.446 30690 64.237.46.132 TCP_MISS/200 0 CONNECT
> 80.95.172.3:25 - DIRECT/80.95.172.3 -
> 1196170407.875 4719 64.237.46.55 TCP_MISS/200 1898 CONNECT
> 204.15.82.30:25 - DIRECT/204.15.82.30 -
> 1196170407.948 5745 64.237.46.55 TCP_MISS/200 404 CONNECT
> 216.122.128.125:25 - DIRECT/216.122.128.125 -
> 1196170407.969 217 208.167.225.68 TCP_MISS/200 0 CONNECT
> 213.246.154.213:25 - DIRECT/213.246.154.213 -
> 1196170408.043 17180 64.237.46.132 TCP_MISS/200 945 CONNECT
> 207.88.96.47:25 - DIRECT/207.88.96.47 -
> 1196170408.739 17415 64.237.46.132 TCP_MISS/200 2266 CONNECT
> 192.43.228.202:25 - DIRECT/192.43.228.202 -
> 1196170408.816 19751 208.167.225.68 TCP_MISS/200 2188 CONNECT
> 66.196.97.250:25 - DIRECT/66.196.97.250 -
> 1196170408.896 2385 64.237.46.55 TCP_MISS/200 253 CONNECT
> 67.152.80.132:25 - DIRECT/67.152.80.132 -
> 1196170409.017 693 64.237.46.55 TCP_MISS/200 108 CONNECT
> 132.77.4.177:25 - DIRECT/132.77.4.177 -
> 1196170409.112 779 64.237.46.55 TCP_MISS/200 436 CONNECT
> 99.161.100.123:25 - DIRECT/99.161.100.123 -
> 1196170409.400 10512 64.237.46.132 TCP_MISS/200 145 CONNECT
> 203.181.255.19:25 - DIRECT/203.181.255.19 -
> 1196170409.434 25 64.237.46.55 TCP_MISS/503 0 CONNECT
> 63.73.11.8:25 - DIRECT/63.73.11.8 -
> 1196170409.560 2179 208.167.225.68 TCP_MISS/200 135 CONNECT
> 213.154.128.18:25 - DIRECT/213.154.128.18 -
> 1196170409.621 5326 208.167.225.68 TCP_MISS/200 421 CONNECT
> 65.220.11.24:25 - DIRECT/65.220.11.24 -
> 1196170410.099 885 64.237.46.132 TCP_MISS/200 429 CONNECT
> 64.18.4.13:25 - DIRECT/64.18.4.13 -
> 1196170410.241 1800 64.237.46.55 TCP_MISS/200 411 CONNECT
> 81.193.127.75:25 - DIRECT/81.193.127.75 -
> 1196170410.388 852 208.167.225.68 TCP_MISS/200 87 CONNECT
> 65.183.202.5:25 - DIRECT/65.183.202.5 -
> 1196170410.517 512 64.237.46.55 TCP_MISS/200 369 CONNECT
> 129.179.7.249:25 - DIRECT/129.179.7.249 -
> 1196170411.091 2823 64.237.46.55 TCP_MISS/200 489 CONNECT
> 194.25.134.8:25 - DIRECT/194.25.134.8 -
> 1196170411.716 1678 208.167.225.68 TCP_MISS/200 421 CONNECT
> 67.139.199.68:25 - DIRECT/67.139.199.68 -
> 1196170411.719 7196 208.167.225.68 TCP_MISS/200 2266 CONNECT
> 74.128.0.19:25 - DIRECT/74.128.0.19 -
> 1196170412.230 2212 64.237.46.55 TCP_MISS/200 409 CONNECT
> 202.216.228.86:25 - DIRECT/202.216.228.86 -
> 1196170412.380 8 64.237.46.55 TCP_MISS/503 0 CONNECT
> 207.44.208.37:25 - DIRECT/207.44.208.37 -
> 1196170412.384 2676 64.237.46.55 TCP_MISS/200 204 CONNECT
> 193.86.123.25:25 - DIRECT/193.86.123.25 -
> 1196170412.538 30581 64.237.46.132 TCP_MISS/200 0 CONNECT
> 206.46.232.11:25 - DIRECT/206.46.232.11 -
> 1196170413.732 1078 64.237.46.55 TCP_MISS/200 347 CONNECT
> 71.40.47.7:25 - DIRECT/71.40.47.7 -
> 1196170413.804 30987 64.237.46.132 TCP_MISS/200 286 CONNECT
> 64.18.7.10:25 - DIRECT/64.18.7.10 -
> 1196170413.908 1745 64.237.46.55 TCP_MISS/200 255 CONNECT
> 158.39.31.190:25 - DIRECT/158.39.31.190 -
> 1196170413.910 31616 64.237.46.132 TCP_MISS/200 180 CONNECT
> 194.88.228.80:25 - DIRECT/194.88.228.80 -
> 1196170414.076 850 64.237.46.55 TCP_MISS/200 341 CONNECT
> 63.254.35.250:25 - DIRECT/63.254.35.250 -
> 1196170414.404 5472 208.167.225.68 TCP_MISS/200 300 CONNECT
> 65.215.152.148:25 - DIRECT/65.215.152.148 -
> 1196170415.526 1812 64.237.46.55 TCP_MISS/200 328 CONNECT
> 209.139.247.226:25 - DIRECT/209.139.247.226 -
> 1196170415.596 929 208.167.225.68 TCP_MISS/200 257 CONNECT
> 64.18.6.13:25 - DIRECT/64.18.6.13 -
> 1196170415.607 742 64.237.46.55 TCP_MISS/200 432 CONNECT
> 63.255.0.140:25 - DIRECT/63.255.0.140 -
> 1196170416.001 59441 64.237.46.132 TCP_MISS/503 0 CONNECT
> 194.193.14.235:25 - DIRECT/194.193.14.235 -
> 1196170416.118 426 208.167.225.68 TCP_MISS/200 311 CONNECT
> 206.54.145.17:25 - DIRECT/206.54.145.17 -
> 1196170416.484 50 64.237.46.55 TCP_MISS/503 0 CONNECT
> 162.40.15.200:25 - DIRECT/162.40.15.200 -
> 1196170416.604 768 208.167.225.68 TCP_MISS/200 443 CONNECT
> 70.62.222.50:25 - DIRECT/70.62.222.50 -
> 1196170416.682 1210 64.237.46.55 TCP_MISS/200 241 CONNECT
> 194.159.138.87:25 - DIRECT/194.159.138.87 -
> 1196170417.010 59063 64.237.46.132 TCP_MISS/503 0 CONNECT
> 68.142.202.247:25 - DIRECT/68.142.202.247 -
> 1196170417.169 964 64.237.46.55 TCP_MISS/200 215 CONNECT
> 198.96.180.81:25 - DIRECT/198.96.180.81 -
> 1196170417.352 797 208.167.225.68 TCP_MISS/200 231 CONNECT
> 80.168.70.65:25 - DIRECT/80.168.70.65 -
> 1196170417.377 1073 208.167.225.68 TCP_MISS/200 318 CONNECT
> 69.20.101.219:25 - DIRECT/69.20.101.219 -
> 1196170417.649 30692 208.167.225.68 TCP_MISS/200 0 CONNECT
> 194.106.221.130:25 - DIRECT/194.106.221.130 -
> 1196170418.282 30006 64.237.46.132 TCP_MISS/200 1994 CONNECT
> 209.191.88.247:25 - DIRECT/209.191.88.247 -
> 1196170418.505 25804 208.167.225.68 TCP_MISS/200 723 CONNECT
> 204.127.217.16:25 - DIRECT/204.127.217.16 -
> 1196170418.884 1374 64.237.46.55 TCP_MISS/200 342 CONNECT
> 205.174.162.116:25 - DIRECT/205.174.162.116 -
> 1196170419.099 31938 64.237.46.132 TCP_MISS/200 193 CONNECT
> 216.86.100.72:25 - DIRECT/216.86.100.72 -
> 1196170419.181 30630 64.237.46.132 TCP_MISS/200 0 CONNECT
> 12.43.220.7:25 - DIRECT/12.43.220.7 -
> 1196170419.614 1078 208.167.225.68 TCP_MISS/200 407 CONNECT
> 75.126.136.142:25 - DIRECT/75.126.136.142 -
> 1196170419.659 1339 208.167.225.68 TCP_MISS/200 257 CONNECT
> 64.18.6.14:25 - DIRECT/64.18.6.14 -
> 1196170419.850 733 208.167.225.68 TCP_MISS/200 336 CONNECT
> 24.173.119.6:25 - DIRECT/24.173.119.6 -
> 1196170419.936 5533 208.167.225.68 TCP_MISS/200 174 CONNECT
> 203.112.24.188:25 - DIRECT/203.112.24.188 -
> 1196170420.102 4395 208.167.225.68 TCP_MISS/200 166 CONNECT
> 216.229.67.195:25 - DIRECT/216.229.67.195 -
> 1196170420.964 30718 64.237.46.132 TCP_MISS/200 0 CONNECT
> 195.252.127.36:25 - DIRECT/195.252.127.36 -
> 1196170421.105 1115 208.167.225.68 TCP_MISS/200 105 CONNECT
> 204.101.14.165:25 - DIRECT/204.101.14.165 -
> 1196170421.114 574 208.167.225.68 TCP_MISS/200 192 CONNECT
> 84.96.93.166:25 - DIRECT/84.96.93.166 -
> 1196170421.410 1829 208.167.225.68 TCP_MISS/200 234 CONNECT
> 195.76.174.39:25 - DIRECT/195.76.174.39 -
> 1196170421.602 171 208.167.225.68 TCP_MISS/200 78 CONNECT
> 24.71.223.11:25 - DIRECT/24.71.223.11 -
> 1196170421.848 155 208.167.225.68 TCP_MISS/200 78 CONNECT
> 24.71.223.11:25 - DIRECT/24.71.223.11 -
> 1196170421.858 645 64.237.46.55 TCP_MISS/200 328 CONNECT
> 69.20.116.136:25 - DIRECT/69.20.116.136 -
> 1196170421.957 59 64.237.46.55 TCP_MISS/200 0 CONNECT
> 64.18.5.10:25 - DIRECT/64.18.5.10 -
> 1196170422.101 30770 64.237.46.132 TCP_MISS/200 0 CONNECT
> 203.135.130.131:25 - DIRECT/203.135.130.131 -
> 1196170422.298 17913 64.237.46.55 TCP_MISS/200 577 CONNECT
> 168.95.5.19:25 - DIRECT/168.95.5.19 -
> 1196170422.551 1265 208.167.225.68 TCP_MISS/200 268 CONNECT
> 218.5.77.18:25 - DIRECT/218.5.77.18 -
> 1196170422.723 37 64.237.46.55 TCP_MISS/503 0 CONNECT
> 208.4.52.29:25 - DIRECT/208.4.52.29 -
> 1196170423.019 197 208.167.225.68 TCP_MISS/200 334 CONNECT
> 65.54.244.8:25 - DIRECT/65.54.244.8 -
>
> ----------------------------------------------------------------------------
>
> As you can see thats nearly 100 hits in 8 seconds. I know this is
> come kind of tool, but I cannot figure out a way to reproduce these
> results.
>
> Our conf for this server is as follows (Host Names and IP addresses
> have been changed incase our other servers are also vulnerable):
>
> ----------------------------------------------------------------------------
>
> http_port 3128
> icp_port 3130
>
>
> cache_dir ufs /var/spool/squid3 100 16 256
> debug_options ALL,9
>
> cache_peer xxx.xxx.xxx.xxx parent 443 7 ssl sslflags=DONT_VERIFY_PEER
> no-query no-digest login=PASS originserver name=bradbury_ats_za
> cache_peer xxx.xxx.xxx.xxx parent 443 7 ssl sslflags=DONT_VERIFY_PEER
> no-query no-digest login=PASS originserver name=weasel_ats
> cache_peer xxx.xxx.xxx.xxx parent 443 7 ssl sslflags=DONT_VERIFY_PEER
> no-query no-digest login=PASS originserver name=reynolds_ats
> cache_peer xxx.xxx.xxx.xxx parent 443 7 ssl sslflags=DONT_VERIFY_PEER
> no-query no-digest login=PASS originserver name=asimov_ats
>
>
> acl sites_on_bradbury_ats_za dstdomain stuff.us.com
> acl sites_on_weasel_ats dstdomain stuff2.us.com
> acl sites_on_reynolds_ats dstdomain stuff3.us.com
> acl sites_on_reynolds_ats dstdomain stuff4.us.com
> acl sites_on_asimov_ats dstdomain stuff5.us.com
> acl sites_on_asimov_ats dstdomain stuff6.us.com
> acl sites_on_asimov_ats dstdomain stuff7.us.com
>
> cache_peer_access bradbury_ats_za allow sites_on_bradbury_ats_za
> cache_peer_access weasel_ats allow sites_on_weasel_ats
> cache_peer_access reynolds_ats allow sites_on_reynolds_ats
> cache_peer_access asimov_ats allow sites_on_asimov_ats
>
>
> acl all src 0.0.0.0/0.0.0.0
> acl localhost src 127.0.0.1/255.255.255.255
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 443 # https
> acl CONNECT method CONNECT
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
>
> http_access allow all
> icp_access allow all
>
>
> coredump_dir /var/spool/squid3
>
>
> httpd_suppress_version_string on
> visible_hostname proxy-us.hrsmart.com
>
> ----------------------------------------------------------------------------
>
> Anyone have any idea how this was being done? If so please respond to
> the list. If you know how to do this, I would appreciate a way to
> reproduce this for my superiors.
>

-- 
Sds.
Alexandre J. Correa
Onda Internet / OPinguim.net
http://www.ondainternet.com.br
http://www.opinguim.net