BOFH peers through the proxy mirror
And finds something illegal, even in Leeds...
Episode 21 BOFH 2004
I CAN'T TAKE IT ANY MORE!!!!
>bip< >bip< >bip< >bip<
>brrrr< >brrrr< ... >brrrr< >brrrr<
"Hello?" the user answers.
"ASTALAVISTA!" I snap down the phone at the user.
"What?!" he gasps, not exactly sure about the reason for my unsolicited call nor its one word content.
"ASTALAVISTA, not ALTAVISTA!"
"What do you mean?" he asks, warily.
"The search engine you wanted - for software cracks."
"Software cracks?" he gasps, faking ignorance.
"Yes, for the pirate game you just downloaded."
"I didn't download a pirate game."
"Of course you did, I saw you on the proxy mirror. I've been watching your session."
"Proxy mirror?" the PFY whispers.
"Yes," I say, muting the phone. "I made some quick changes to the Squid and Mozilla source allowing me to pick a client IP on the proxy and basically get the same content as them."
"Smooth," the PFY responds, nodding. "What if they're using IE?"
"I've dumbed Mozilla down to cope with it."
"Isn't that... an invasion of privacy?" the user interrupts tentatively.
"No, an invasion of privacy would be if I were to ring your wife and ask her how she liked those flowers you ordered over the Internet and mistakenly sent to the new girl in salaries, who is patently disinterested in your advances..."
"Or if I played back your website browsing of two weeks ago, when you were 'working late'. That was a flashcard session I don't think I'll forget in a hurry!"
"So, if we go back to the original case in point, astalavista. Not altavista."
"He hung up!" the PFY blurts.
"True. But look, he's going to astalavista, so my work is done. What are you up to?"
"As it happens, something which fits in snugly with you?"
"You're dating the new girl in salaries!" I gasp, foiled again. "After all that work I did on changing the attached note on that guy's flower order."
"What? No no, I've just submitted OUR proxy address to an open, anonymous proxy list on some questionable websites."
"And you were going to use my proxy mirror."
"No, I was just going to turn on full cacheing and grab copies of anything interesting that people 'found' on the Web."
"And by interesting you were meaning..."
"Pirated software mainly," the PFY blurts.
"Not Internet porn?"
"Nah, you can get that anywhere. But a limited pre-release version of a new first person shooter game is worth it's weight in gold."
"Of course it is!" I say doubtfully.
"So how does this proxy mirror of yours work then?" the PFY asks.
"You go to the index page, which lists the IP addresses it believes are still currently using the proxy and the last link they actively clicked on. Using your advanced ferret-like nose for naughtiness, you click on the address most likely to be doing dodgy stuff and bob's your auntie, the proxy feeds both of you the content that they're seeing - without them knowing."
"That's fantastic!" the Boss blurts, appearing as if by magic behind us.
"Where the hell did you come from?"
"The tape cupboard you locked me in this morning!"
"Oh yeah," the PFY murmurs to himself. "I really should have put up a sign."
"I'll get back to that later," the Boss seethes, "but for the meantime, tell me more about this mirror thing. You can watch anyone's traffic?"
"I suppose," I admit grudgingly.
"And they don't know."
"And how do you access it?"
"You don't - it's not really in production yet - more of a work in progress," I babble.
"Yeah well, I think I'd like to have a look at the sort of thing we're downloading, so just email me the address," he says, ambling at a slow run to get back to his desktop in time.
"Houston, we have a problem," I say to the PFY once he's gone.
"Because in no time he'll realise just how little work-related stuff is done, do a bit of maths about how much the network connectivity costs us, and recommend something stupid like bandwidth restrictions or content filtering at the ISP?!"
"We could turn the proxy off."
"Disable new connections."
"The users would complain pretty quick and give the game away."
"Tricky," the PFY blurts. "Unless..."
. . .
"Disgusting," the Head of IT says, as I show him the proxy mirror in action. "Is that sort of thing even legal here?"
"I don't even think it's even legal in Leeds!" I blurt.
"And you're sure you're not mistaken?"
"Only one way to find out..." I respond.
. . .
Ten minutes after the Boss's door has been crash-opened by security I let the PFY know that he can stop his whirlwind tour of the nastiest sites on the Internet. The damage is done, and the Boss' protestations of innocence fall on deaf ears. Doubly so, when the head of IT notes he's been saving some of the data to his desktop machine. Naughty!
Five minutes after that, as the Boss is hailing a cab with his box of personal possessions, the PFY stops in to congratulate me on my work.
"Work?" I say. "No, I just consider it pushing back the frontiers of Computing Science."
Lets face it, some of us are born sneaky, others have sneakiness thrust upon them. ®
BOFH is copyright © 1995-2004, Simon Travaglia. Don't mess with his rights.
Sponsored: Becoming a Pragmatic Security Leader