New Threat That Can Be Used to Divert Web Traffic Through a Malicious Proxy Server

    Recently Microsoft warned us about a new weakness point that could be used to divert web traffic through a malicious proxy server. For example Internet Explorer use the Web Proxy Automatic Discovery (WPAD) protocol to find a file that enables a browser to configure its proxy settings. Company representatives said It's possible to plant a configuration file that would route traffic through a malicious proxy. A malicious WPAD.dat file could be placed in the Domain Name System (DNS) or the Windows Internet Naming Service (WINS). The client application looks in DNS or WINS to resolve the name of the hosting that has the proxy configuration file. Microsoft said that after the file placed there, WPAD clients "may be able to route their Internet traffic through a malicious proxy server."

    Network managers should reconfigure DNS and WINS on their servers to help prevent the use of this hack. The recommended fix helps prevent the insertion of the malicious file in the server's Domain Name System (DNS) or Windows Internet Naming Service (WINS). The fix is for Windows Server 2003 and Windows 2000 Service Pack 4.

More information is available from Microsoft:

"Client software that is configured to use Web Proxy Automatic Discovery (WPAD) must be able to contact a host that serves a proxy automatic configuration file (Wpad.dat). A WPAD-configured client can use several methods to locate a host that contains a Wpad.dat file. Two of these methods require a WPAD entry to be registered in Domain Name System (DNS) or in Windows Internet Naming Service (WINS). Registering a WPAD entry in DNS or in WINS enables clients to resolve names of hosts that contain proxy automatic configuration files.
If an entity can surreptitiously register a WPAD entry in DNS or in WINS, and this entry resolves to a host with a malicious Wpad.dat file, WPAD clients may be able to route their Internet traffic through a malicious proxy server. Network administrators who have not already registered legitimate WPAD entries in DNS or in WINS, and network administrators who have not correctly implemented WPAD through DHCP and Option 252, must reserve static WPAD DNS host names and WPAD WINS name records. By doing this, network administrators help prevent possible malicious registrations."

The five steps used to reserve static WPAD DNS host names and to reserve WPAD WINS name records, are available at their web site: http://support.microsoft.com/kb/934864