, SecurityFocus 2002-12-10
Never let it be said that the United States Senate has done nothing for Internet privacy.
A proxy server is normally a dedicated machine that sits between a private network and the outside world, passing internal users' Web requests out to the Internet. But they're sometimes misconfigured to accept and forward connections from the outside as well, allowing anyone on the Internet to route through the proxy with a simple browser configuration change.
Because server logs at destination sites show only the IP address of the proxy server, and not the end user, some hackers and privacy-conscious netizens
Tracy Williams, director of technology development for the Senate Sergeant-at-Arms, blamed the Senate's accidental public service on misconfigured devices "associated" with the Web site. "Those have been taken offline until they can be configured correctly," said Williams.
Although open proxies sometime allow unauthorized ingress to an internal network, Williams said that in this case the Senate's networks were not exposed.
The proxy was discovered by hacker Adrian Lamo, who's
The hacker said he noticed the Senate Web site's undocumented feature while reviewing a list of proxy servers he scanned and cataloged last April. Uncharacteristically,
"I went to a non-existent Web site with a longly-structured URL consisting of a sentence indicating that they had an open proxy, and giving my name and contact information," said Lamo.
Williams said administrators found and closed the proxy last weekend after "we picked up anomalous behavior on our intrusion detection system."
