Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Glype proxy may not cloak your identity

Popular 'anonymous' service reveals sensitive information, says researcher

Article comments

A widely used proxy service thought to provide anonymous Web surfing and used to skirt network administrator bans on access to sites like Facebook frequently reveals sensitive information about its users, according to a Swiss security researcher.

Glype is a small bit of PHP code that routes requests for Web pages through other Web pages running its software, said the researcher, who runs the Swiss Security Blog and the Zeus Tracker project. He prefers to remain anonymous.

The Glype code allows someone to, for example, access Facebook at work even if that page is blocked, as it appears the traffic is coming from the Web page running the proxy. Many companies now block sites such as Facebook.

Glype's code is free, and anyone can install it on their Web page. But Glype is frequently misconfigured, the researcher said. It allow someone running a Glype proxy to turn on a log, which shows the IP (Internet protocol) address of the user, what site they requested and the time.

Many of those people running a Glype proxy have not turned that logging function off, and worse yet, made it Web facing, meaning that URLs can be manipulated to reveal full logs.

The researcher checked about 20 Glype proxies, found 1,700 logs files and more than one million unique IP addresses. "There are dozens of such 'insecure' proxies out there," he said via instant message on Friday.

Among the top users of Glype are people in China, according to his research. Some of the top sites visited using Glype were Chinese pornography sites, YouTube and Facebook.

Further investigation showed that many of the IP addresses making page requests were within government and military agencies around the world, although the researcher declined to specify which agencies.

In one instance, the researcher found a government user who visited Facebook.

"The log files provide a link to a profile of an employee of the ministry of foreign affairs," the researcher wrote. "When I checked the profile, I just noticed that this user is obviously an employee of the security service at the ministry of foreign affairs."

Depending on the privacy settings of a person's Facebook page, it may be possible to view personal details and gain a fuller picture of who that particular Web surfer using Glype knows.

"If this were an intelligence collection operation, you'd now have the identity of a government or military employee, the name of his agency, all of his personal information that's been shared online plus his entire social network," wrote Jeffrey Carr, CEO of GreyLogic, on his blog IntelFusion. "It doesn't get much better than this in the world of open source intelligence (OSINT)."

Even if some people had not misconfigured Glype logging features, they would still be able to see where all the users who came through their server went on the Web, the researcher said. People should not trust a random Web page running Glype, he said.

An alternative kind of proxy server called The Onion Router or TOR provides a much higher level of anonymity but also is much slower, the researcher said.

TOR is a worldwide network of servers that are used to help make Web surfing anonymous by randomly routing traffic through many servers, masking critical information such as someone's true IP (Internet Protocol) address. TOR servers also can't identify the complete chain of TOR servers used for a page request.



Share:

More from Techworld

More relevant IT news

Comments

John Mill said: httpadflyCtbfr glype example



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *