Abuse Committee » ProxyScan Information

You're likely here because you're curious of a hit on your firewall by us, or are interested in the reason we check all users upon connection to the network. Well, read on ...

Due to the overwhelming abuse of misconfigured Wingate, Socks and Proxy servers being exploited daily, we are now checking all users upon connection. This is our effort to prevent abuse of our network, and your fellow users. This scan is only completed if a user successfully connects to the network and should be noted it is not an attack on your system in any way.

Our AUP ('Acceptable Use Policy') states:

We reserve the right to scan your system(s), upon connection, for the presence of open proxies/wingates which could pose a possible security threat to our network and users

Be aware that this sort of connection to your system is common if you use free Internet services (such as IRC networks, game servers etc). If you do not desire this type of check to occur, then configure your firewall to block access to these scans.

The Xtris ProxyScan will originate from the host: ProxyScan.Xtris.net

Please remember that connection to and use of the Xtris Network is conditional upon acceptance of any and all applicable policies of the Acceptable Use Policy (and its related documents) and its Indemnify and Hold Harmless clause.

Are you affected, or have been Glined by our Proxy Scanner?

Fixing a Wingate server:

If your Wingate server version is 2.1 (or prior): http://www.deerfield.com/support/wingate/kb/index.htm?a=1314
Get help with a Wingate server at: http://www.practicallynetworked.com/sharing/secureproxy.htm

Fixing a Socks 4/5 server:

If you run a Unix Socks 4 or Socks 5 server, check your ACL

Fixing a Proxy Server on a Windows machine:

Socks Proxy Server: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnproxy/html/msdn_proxycase.asp
Upgrade and find help for your WinProxy: http://www.winproxy.com/
Upgrade your Sygate Server: http://www.sygate.com

Fixing a Squid server:

Get help for Squid ACLs at: http://www.squid-cache.org/Doc/FAQ/FAQ-10.html#ss10.2
Get detailed help at: http://www.documents.cyberabuse.org/?page=vulnerabilities
Upgrade your Squid 1.x server at: http://www.squid-cache.org/

Fixing a HTTP proxy server:

Take a look at your manual for the ACL feature
Vulnerable proxy servers can be of all types and brands. If your proxy server is not supported anymore and you are not sure about your configuration, firewall it so only your LAN can use it
Get help about WinRoute at www.kerio.com. They have a manual in PDF format found under downloads / support
Get detailed help about CacheFlow at: http://www.documents.cyberabuse.org/?page=vulnerabilities

You can then check for a misconfiguration by using the CyberAbuse Web Proxyscanner

Okay, how do I get my Gline removed?

After you have verified your system is once again secure, please let us know by using the Gline Disputes Form. We'll gladly remove these glines.

Please note, however, that these glines only last 1 hour from the time of issue; it may be worth checking you're still glined before using the Gline Disputes Form.

As always, if you require assistance feel free to ask on our Support Form.

Please remember that we take no responsibility for the content of external websites

Last revised by: Jo

QOTD: Feelings of worth can flourish only in an atmosphere where individual differences are appreciated, mistakes are tolerated, communication is open, and rules are flexible - the kind of atmosphere that is found in a nurturing family. -- Virginia Satir