For example, let's say a network admin is blocking outgoing POP3 traffic, which in turn prevents users from accessing their outside e-mail accounts. Through this tunnel, the network user could encapsulate all his POP3 traffic as HTTP and forward it to his home computer via the network's default gateway over port 80. Incoming traffic would take the reverse path and appear as a legal Web request. It's sinisterly ingenious. The same technique could allow users to establish a proxy link to a browser outside the network, giving them an unrestricted ability to surf the Web and collect prohibited materials.
Companies implement security policies for a reason.
For example, keeping users from accessing external POP3 mail servers or telnet-based applications prevents sensitive information from leaving the protection of the corporate network without a protective cloak of encryption. Tunnels also can provide attackers with a clear channel for planting sniffers or Trojan horse programs that could eavesdrop on network activities. The tunnel is a near perfect backdoor since most firewalls allow HTTP traffic to pass through, both ways, unhindered. The attacker's traffic can also escape IDS detection because it's buried in a deluge of HTTP logging data. Right now, there's no effective tool for detecting an HTTP tunnel or the software used to create them.