Scenario A:
-----------

A user points his web browser to `https://users.server.com`. The website completes the SSL handshake and continues with the HTTP protocol inside SSL.

Scenario B:
-----------

*(server-side)*
Now, let's say `users.server.com` is modified to run this `socat`:

```
socat OPENSSL-LISTEN:443,cert=path_to_cert TCP4:127.0.0.1:22

```

*(client-side)*
Then, the user has the following `socat` running:

`socat TCP4-listen:6666 OPENSSL:the.server.host.com:443`

Then, the user points his PuTTY client to `localhost:6666` effectively establishing an SSL'd SSH connection to `the.server.host.com:22`.

---

Is there any way to distinguish the traffic from the above scenarios? My concern is that a user inside my network could effectively circumvent our firewall by piping any TCP traffic out through SSL on port 443. Would this traffic look any different than HTTPS traffic? Are there differences in the SSL handshake types? We have mechanisms in place to drop any non-HTTP on port 80 and non-SSL traffic on port 443 through our HTTP proxy. (all other outbound is blocked). I'm hoping I can only allow HTTPS (SSL'd HTTP) on port 443.

The attack is detailed [here](http://www.radarhack.com/tutorial/DEFEATING_THE_NETWORK_SECURITY_INFRASTRUCTURE.pdf) (pdf).

I'm aware that if I can install a root CA certificate on the user's machine, I could mitm the SSL. But that's not feasible. I am more interested in *detecting* this at the network layer. Preventing may be another measure.