IPHide Vulnerable to UTF-7 And May Be Phishing
I like to report on these about once a month because they keep popping up and people keep selling them like they are the be-all end-all to privacy. Non parsed header CGI proxies are not secure from a privacy perspective. They just aren’t. Not only because they are vulnerable to XSS, but because they can leak your information to the party you are trying to avoid having your information leaked to. In the case of IPHide.com it’s no different. IPHide is vulnerable to the UTF-7 XSS vector. That means that any page you go to using IPHide and authenticate to is vulnerable to having your information stolen, which is kinda bad, I guess, but more importantly, your information can be transferred over the wire to locate your real IP.
Like I said in an earlier post, if you are relying on this to not get kicked out of school or busted by your office, you had better think twice. Unlike a normal proxy it relies heavily on two things 1) being able to strip out any content that could possibly leak where you are really intending to go and 2) the content filter not using patterns that could be used to pick up the fact that you are in fact surfing for porn or hacking or whatever it is you’re doing that you shouldn’t be. Although I must say it is ridiculously easy to get around content filters if you control both the client and the server, it’s much harder to properly filter out all forms of active content.
Now onto the second part of this, none of the links on the bottom of the page (FAQ, Privacy Policy, Terms of Service, or About us) are valid links. So either this is just a terribly sloppy page, or it is a way for people to steal information from you (login credentials). Sort of like phishing, only you are knowingly using a proxy. Kinda clever if it is being used as that. I don’t assume to say one way or another, it just struck me as an amusing way to abuse people’s paranoia to get information from them.
April 6th, 2007 at 10:36 am
The links work for me, at least on the main page…
April 6th, 2007 at 10:38 am
Weird, they are still broken for me, are you sure you’re clicking on the links on the bottom?
April 6th, 2007 at 10:51 am
I wouldn’t say iphide.com is vulnerable so much as CGI Proxy - the software that they’re using - is. More information:
http://www.jmarshall.com/tools/cgiproxy/
Also, the UTF-7 vector that you’re using is of limited usefulness in IE7 because GET parameters are not UTF-7 decoded. More information:
http://www.frostjedi.com/terra/scripts/demo/frameBug.html
Now, if you force a charset via HTTP headers, UTF-7 won’t work, but… in IE6/7, UTF-16 will. The reason being that, at this point, the “Null breaks up cross site scripting vector”, as described on the XSS cheat sheet kicks in.
Here’s a more complete demo:
http://www.frostjedi.com/terra/scripts/ip_unmasker.php
Combine this with the Java applet, as I have, and you can see someone’s “real” IP address even if they’re using both a CGI proxy and a traditional HTTP proxy.
April 6th, 2007 at 1:54 pm
Very nice. I wasn’t so interested in actually doing this, but yes, in fact that would be a better way to do that if you were actually trying to locate someone using this sort of CGI proxy.